# AWS Secrets Manager

> Store and rotate secrets in AWS Secrets Manager. Configure automatic rotation, access policies, and application integration. Use when managing secrets in AWS environments or requiring automatic credential rotation.

- Skill: `majiayu000/aws-secrets-manager` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds add majiayu000/aws-secrets-manager`
- Raw SKILL.md: https://api.skillmd.com/api/skills/majiayu000/aws-secrets-manager/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- License: MIT
- Author: majiayu000 (https://skillmd.com/u/majiayu000)
- Updated: 2026-09-09
- Page: https://skillmd.com/skills/majiayu000/aws-secrets-manager

---


# AWS Secrets Manager

Securely store, manage, and rotate secrets in AWS.

## When to Use This Skill

Use this skill when:
- Storing database credentials
- Managing API keys in AWS
- Implementing automatic secret rotation
- Integrating secrets with AWS services

## Prerequisites

- AWS account
- AWS CLI configured
- IAM permissions for Secrets Manager

## Basic Operations

```bash
# Create secret
aws secretsmanager create-secret \
  --name myapp/database \
  --secret-string '{"username":"admin","password":"secret123"}'

# Get secret
aws secretsmanager get-secret-value --secret-id myapp/database

# Update secret
aws secretsmanager put-secret-value \
  --secret-id myapp/database \
  --secret-string '{"username":"admin","password":"newpassword"}'

# Delete secret
aws secretsmanager delete-secret --secret-id myapp/database --recovery-window-in-days 7
```

## Automatic Rotation

```bash
# Enable rotation with Lambda
aws secretsmanager rotate-secret \
  --secret-id myapp/database \
  --rotation-lambda-arn arn:aws:lambda:region:account:function:rotation-function \
  --rotation-rules AutomaticallyAfterDays=30
```

## Application Integration

```python
import boto3
import json

def get_secret(secret_name):
    client = boto3.client('secretsmanager')
    response = client.get_secret_value(SecretId=secret_name)
    return json.loads(response['SecretString'])

# Usage
creds = get_secret('myapp/database')
db_connect(creds['username'], creds['password'])
```

## Best Practices

- Enable automatic rotation
- Use resource-based policies
- Enable encryption with KMS
- Implement least-privilege access
- Use versioning for rollback

## Related Skills

- [hashicorp-vault](../hashicorp-vault/) - Multi-cloud secrets
- [aws-iam](../../../infrastructure/cloud-aws/aws-iam/) - IAM policies