Getting Started with AWS Secrets Manager
Learn how to securely create and retrieve secrets in your AWS environment.
Step 1: Create Your First Secret
Create a secret using AWS CLI with this simple command:
$ aws secretsmanager create-secret
--name /my-application-dev/db-credentials
--description "Production DB Credentials"
--secret-string '{"username":"admin","password":"s3cr3t"}''
Replace `/my-application-dev/db-credentials` with your preferred secret name and update the JSON string with your actual credentials.
Step 2: Retrieve Your Secret
Retrieve a secret for programmatic access using the AWS SDK in Python:
import> boto3>client = >boto3>.client('secretsmanager',
region_name='us-west-2')')>response = client.get_secret_value(>SecretId='/my-application-dev/db-credentials''>))
This code retrieves the secret string as a dictionary you can use in your application.
Best Practices
- Always rotate secrets using automated Lambda functions
- Store sensitive data only in dedicated secret resources
- Use IAM policies to enforce least-privilege access
- Enable CloudWatch logging for audit trails
- Test secret access patterns in non-production environments first