DevOps-Security-Agent-Skills/security/secrets/aws-secrets-manager/SKILL.md

name, description, license, metadata

name	description	license	metadata
aws-secrets-manager	Store and rotate secrets in AWS Secrets Manager. Configure automatic rotation, access policies, and application integration. Use when managing secrets in AWS environments or requiring automatic credential rotation.	MIT	author version devops-skills 1.0

AWS Secrets Manager

Securely store, manage, and rotate secrets in AWS.

When to Use This Skill

Use this skill when:

• Storing database credentials
• Managing API keys in AWS
• Implementing automatic secret rotation
• Integrating secrets with AWS services

Prerequisites

• AWS account
• AWS CLI configured
• IAM permissions for Secrets Manager

Basic Operations

# Create secret
aws secretsmanager create-secret \
  --name myapp/database \
  --secret-string '{"username":"admin","password":"secret123"}'

# Get secret
aws secretsmanager get-secret-value --secret-id myapp/database

# Update secret
aws secretsmanager put-secret-value \
  --secret-id myapp/database \
  --secret-string '{"username":"admin","password":"newpassword"}'

# Delete secret
aws secretsmanager delete-secret --secret-id myapp/database --recovery-window-in-days 7

Automatic Rotation

# Enable rotation with Lambda
aws secretsmanager rotate-secret \
  --secret-id myapp/database \
  --rotation-lambda-arn arn:aws:lambda:region:account:function:rotation-function \
  --rotation-rules AutomaticallyAfterDays=30

Application Integration

import boto3
import json

def get_secret(secret_name):
    client = boto3.client('secretsmanager')
    response = client.get_secret_value(SecretId=secret_name)
    return json.loads(response['SecretString'])

# Usage
creds = get_secret('myapp/database')
db_connect(creds['username'], creds['password'])

Best Practices

• Enable automatic rotation
• Use resource-based policies
• Enable encryption with KMS
• Implement least-privilege access
• Use versioning for rollback

Related Skills

• hashicorp-vault - Multi-cloud secrets
• aws-iam - IAM policies