Secrets Manager for credentials in AWS - Commands & Configuration

Introduction

Storing passwords and keys directly in your app is risky. AWS Secrets Manager helps you keep these credentials safe and easy to update without changing your app code.

When you want to store database passwords securely and access them from your app.

When you need to rotate API keys automatically without downtime.

When multiple apps or services need to share the same secret safely.

When you want to avoid hardcoding sensitive info in configuration files.

When you want to audit who accessed your credentials and when.

Commands

This command creates a new secret named 'my-app-db-password' in AWS Secrets Manager with a username and password stored as a JSON string.

Terminal

aws secretsmanager create-secret --name my-app-db-password --secret-string "{\"username\":\"admin\",\"password\":\"S3cureP@ssw0rd\"}" --region us-east-1

Expected Output

{

    "ARN": "arn:aws:secretsmanager:us-east-1:123456789012:secret:my-app-db-password-abc123",

    "Name": "my-app-db-password",

    "VersionId": "EXAMPLE1-90ab-cdef-fedc-ba987SECRET1"

}

→

--name - Sets the unique name for the secret.

→

--secret-string - Provides the secret data as a string.

→

--region - Specifies the AWS region to store the secret.

This command retrieves the stored secret value so your app or admin can use the credentials safely.

Terminal

aws secretsmanager get-secret-value --secret-id my-app-db-password --region us-east-1

Expected Output

{

    "ARN": "arn:aws:secretsmanager:us-east-1:123456789012:secret:my-app-db-password-abc123",

    "Name": "my-app-db-password",

    "VersionId": "EXAMPLE1-90ab-cdef-fedc-ba987SECRET1",

    "SecretString": "{\"username\":\"admin\",\"password\":\"S3cureP@ssw0rd\"}",

    "VersionStages": [

        "AWSCURRENT"

    ],

    "CreatedDate": 1686000000.0

}

→

--secret-id - Specifies which secret to retrieve.

→

--region - Specifies the AWS region where the secret is stored.

This command updates the secret with a new password without changing the secret name or ARN.

Terminal

aws secretsmanager update-secret --secret-id my-app-db-password --secret-string "{\"username\":\"admin\",\"password\":\"N3wP@ssw0rd123\"}" --region us-east-1

Expected Output

{

    "ARN": "arn:aws:secretsmanager:us-east-1:123456789012:secret:my-app-db-password-abc123",

    "Name": "my-app-db-password",

    "VersionId": "EXAMPLE2-90ab-cdef-fedc-ba987SECRET2"

}

→

--secret-id - Specifies which secret to update.

→

--secret-string - Provides the new secret data.

→

--region - Specifies the AWS region.

This command deletes the secret immediately without waiting for recovery, useful when the secret is no longer needed.

Terminal

aws secretsmanager delete-secret --secret-id my-app-db-password --region us-east-1 --force-delete-without-recovery

Expected Output

{

    "ARN": "arn:aws:secretsmanager:us-east-1:123456789012:secret:my-app-db-password-abc123",

    "Name": "my-app-db-password",

    "DeletionDate": 1686003600.0

}

→

--secret-id - Specifies which secret to delete.

→

--force-delete-without-recovery - Deletes the secret immediately without recovery window.

→

--region - Specifies the AWS region.

Key Concept

If you remember nothing else from this pattern, remember: AWS Secrets Manager lets you store and update sensitive credentials safely without hardcoding them in your app.

Common Mistakes

Trying to retrieve a secret without specifying the correct region.

AWS CLI will fail to find the secret if the region is wrong or missing.

Always include the --region flag with the region where your secret is stored.

Hardcoding secrets directly in application code instead of using Secrets Manager.

This exposes sensitive data and makes rotation difficult and risky.

Store secrets in Secrets Manager and retrieve them securely at runtime.

Deleting secrets without understanding the recovery window or using force delete unintentionally.

You may lose access to secrets permanently if deleted immediately by mistake.

Use the default recovery window unless you are sure you want to delete immediately with --force-delete-without-recovery.

Summary

Create secrets with aws secretsmanager create-secret to store credentials safely.

Retrieve secrets with aws secretsmanager get-secret-value when your app needs them.

Update secrets with aws secretsmanager update-secret to rotate passwords without downtime.

Delete secrets with aws secretsmanager delete-secret carefully, considering recovery options.

Practice

1. What is the main purpose of AWS Secrets Manager?

easy

A. To securely store and manage sensitive information like passwords and keys

B. To host websites and web applications

C. To monitor network traffic and logs

D. To provide virtual machines for computing

Solution

1. Step 1: Understand Secrets Manager's role

   AWS Secrets Manager is designed to keep sensitive data like passwords and API keys safe and separate from application code.

2. Step 2: Compare options to this role

   Options B, C, and D describe other AWS services or functions unrelated to Secrets Manager.

3. Final Answer:

   To securely store and manage sensitive information like passwords and keys -> Option A

4. Quick Check:

   Secrets Manager = Secure storage for secrets [OK]

Hint: Secrets Manager = safe place for passwords and keys [OK]

Common Mistakes:

• Confusing Secrets Manager with hosting or monitoring services
• Thinking it manages virtual machines
• Assuming it stores non-sensitive data

2. Which of the following is the correct AWS CLI command to retrieve a secret value from Secrets Manager?

easy

A. aws secrets get-value --secret MySecret

B. aws secretsmanager fetch-secret --id MySecret

C. aws secretsmanager get-secret-value --secret-id MySecret

D. aws secretmanager retrieve --name MySecret

Solution

1. Step 1: Recall the correct AWS CLI syntax for Secrets Manager

   The official command to get a secret's value is 'aws secretsmanager get-secret-value' with the '--secret-id' parameter.

2. Step 2: Check each option's correctness

   Options A, B, and C use incorrect commands or parameters that do not exist in AWS CLI.

3. Final Answer:

   aws secretsmanager get-secret-value --secret-id MySecret -> Option C

4. Quick Check:

   Correct CLI command = aws secretsmanager get-secret-value --secret-id MySecret [OK]

Hint: Remember 'get-secret-value' with '--secret-id' for retrieval [OK]

Common Mistakes:

• Using wrong command verbs like fetch or retrieve
• Mixing up parameter names
• Assuming 'secretmanager' is spelled differently

3. Given this Python code snippet using boto3 to get a secret, what will be printed if the secret exists and contains JSON with key 'password'?

import boto3
import json
client = boto3.client('secretsmanager')
response = client.get_secret_value(SecretId='MySecret')
secret = json.loads(response['SecretString'])
print(secret['password'])

medium

A. The entire JSON string without parsing

B. The password string stored in the secret

C. An error because 'SecretString' is missing

D. None, because the secret is not decoded

Solution

1. Step 1: Understand the boto3 get_secret_value response

   The response contains 'SecretString' which holds the secret as a JSON string. The code parses it with json.loads.

2. Step 2: Access the 'password' key from parsed JSON

   After parsing, secret['password'] accesses the password value stored in the secret, which is printed.

3. Final Answer:

   The password string stored in the secret -> Option B

4. Quick Check:

   Parsed JSON secret prints password value [OK]

Hint: Parse 'SecretString' JSON then access keys [OK]

Common Mistakes:

• Trying to print 'SecretString' without parsing
• Assuming 'SecretBinary' is used here
• Not loading JSON before accessing keys

4. You wrote this code to get a secret but get a KeyError: 'SecretString'. What is the likely cause?

response = client.get_secret_value(SecretId='MySecret')
print(response['SecretString'])

medium

A. The secret ID is incorrect

B. The secret is empty and has no keys

C. The client is not authenticated

D. The secret is stored as binary, so 'SecretString' key is missing

Solution

1. Step 1: Understand the response keys from get_secret_value

   If the secret is stored as binary, the response contains 'SecretBinary' instead of 'SecretString'. Accessing 'SecretString' causes KeyError.

2. Step 2: Identify cause of KeyError

   The error means 'SecretString' key is missing, likely because the secret is binary, not string.

3. Final Answer:

   The secret is stored as binary, so 'SecretString' key is missing -> Option D

4. Quick Check:

   Binary secret = no 'SecretString' key [OK]

Hint: Check if secret is binary; then use 'SecretBinary' key [OK]

Common Mistakes:

• Assuming secret is always a string
• Ignoring authentication errors
• Thinking secret ID typo causes KeyError

5. You want your application to automatically rotate database credentials stored in Secrets Manager every 30 days. Which approach is best to achieve this securely and with minimal manual work?

hard

A. Enable Secrets Manager automatic rotation with a Lambda function that updates the database credentials

B. Manually update the secret value in Secrets Manager every 30 days

C. Store credentials in environment variables and update them manually

D. Use a cron job on the application server to change database passwords and update Secrets Manager

Solution

1. Step 1: Understand Secrets Manager rotation feature

   Secrets Manager supports automatic rotation using Lambda functions to update credentials securely without manual intervention.

2. Step 2: Compare options for automation and security

   Enable Secrets Manager automatic rotation with a Lambda function that updates the database credentials uses built-in rotation with Lambda, which is secure and automatic. Options B, C, and D require manual steps or insecure practices.

3. Final Answer:

   Enable Secrets Manager automatic rotation with a Lambda function that updates the database credentials -> Option A

4. Quick Check:

   Automatic rotation with Lambda = best practice [OK]

Hint: Use Secrets Manager rotation with Lambda for auto updates [OK]

Common Mistakes:

• Relying on manual updates risking stale credentials
• Storing secrets insecurely in environment variables
• Using external cron jobs instead of built-in rotation