What problem does it solve? Manually creating secrets in AWS Secrets Manager often skips critical security controls like dedicated KMS encryption, automatic rotation, and least-privilege access, leaving credentials exposed. This Skill walks through a complete procedure that applies production-grade security controls to every secret you create. ## Core Features & Use Cases - Secure Secret Creation: Creates database credentials, API keys, OAuth tokens, and custom secrets encrypted with a dedicated KMS key whose policy is scoped to Secrets Manager via the kms:ViaService condition. - Automatic Rotation: Configures rotation intervals, AWS-managed rotation for database secrets, and custom Lambda rotation functions with an initial test rotation. - Least-Privilege Access & Auditing: Generates scoped IAM policies with aws:SecureTransport enforcement, verifies CloudTrail logging, and sets up CloudWatch alarms for failed retrievals and rotation failures. - Use Case: You need to store production database credentials for a new application. Provide the secret name, type, value, and region, and the Skill provisions the KMS key, secret, rotation schedule, IAM policy, and monitoring alarms in one guided workflow. ## Quick Start Create a new database secret named prod-database-credentials in us-east-1 with automatic 30-day rotation and least-privilege access following security best practices.
