skills.rest
mreferre
mreferreCOMMUNITY
Explore all skills by this author →
Website𝕏@mreferreGitHub

creating-secrets-using-best-practices

Create AWS Secrets Manager secrets with KMS encryption, rotation, and least-privilege IAM.

Updated May 12, 2026
Search Tags:#aws secrets manager#lifecycle management#secret rotation#kms encryption#iam least privilege#cloudtrail auditing#secure transport
One-click install
npx skills add https://github.com/mreferre/aws-agent-toolkit-skills --skill creating-secrets-using-best-practices-mreferre
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: creating-secrets-using-best-practices
Source: https://github.com/mreferre/aws-agent-toolkit-skills/tree/main/.kiro/skills/creating-secrets-using-best-practices
Command: npx skills add https://github.com/mreferre/aws-agent-toolkit-skills --skill creating-secrets-using-best-practices-mreferre

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

Creating secrets without strong encryption, rotation, least-privilege access, and auditability leads to avoidable security incidents and operational risk.

Core Features & Use Cases

  • KMS-encrypted Secrets Manager setup: Creates dedicated KMS keys and scopes their use so Secrets Manager is the intended encryption path.
  • Automatic rotation with validation: Enables rotation (including AWS-managed rotation for common types and Lambda-based rotation for custom types).
  • Least-privilege IAM and auditing: Produces scoped IAM policies with HTTPS enforcement and ensures CloudTrail/CloudWatch monitoring is in place.
  • Lifecycle management: Applies tagging, deletion recovery window, and operational guardrails for ongoing security and governance.

Quick Start

Create a secret using the required parameters in one request, including secret_name, secret_description, secret_type, secret_value, and aws_region.

Frequently Asked Questions about creating-secrets-using-best-practices

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I create AWS Secrets Manager entries with KMS encryption and IAM least privilege?▼

To create AWS Secrets Manager secrets with KMS encryption and IAM least privilege, provision dedicated KMS keys scoped via kms:ViaService and attach HTTPS-enforced IAM policies. This ensures secrets are encrypted through the intended path and access is tightly restricted.

What's the best way to set up automatic secret rotation for database credentials in AWS?▼

The best way to set up automatic secret rotation for database credentials in AWS is using Secrets Manager's AWS-managed rotation templates for common types, or deploying Lambda-based rotation functions for custom secret structures, validating rotation cycles securely.

Can I enforce HTTPS-only access to prevent exposing secret values in CloudTrail logs?▼

Yes, you can enforce HTTPS-only access to AWS Secrets Manager using aws:SecureTransport conditions in IAM policies. This secure transport constraint prevents exposing secret values in CloudTrail logs or API outputs during retrieval operations.

How does lifecycle management work for AWS Secrets Manager secrets?▼

Lifecycle management for AWS Secrets Manager secrets applies operational guardrails like resource tagging, configured deletion recovery windows, and CloudTrail auditing. This governance approach maintains ongoing security and compliance for stored credentials and API keys.

Do I need a custom Lambda function to rotate OAuth tokens stored in AWS Secrets Manager?▼

You need a custom Lambda function to rotate OAuth tokens stored in AWS Secrets Manager only if they use custom secret structures. Common database credential types can use AWS-managed rotation templates without requiring custom Lambda code.

Why should I scope KMS key policies with kms:ViaService for Secrets Manager?▼

You should scope KMS key policies with kms:ViaService for Secrets Manager to ensure the dedicated KMS key is only used for encryption through the Secrets Manager service path. This prevents direct KMS API access from bypassing secret-level governance controls.

Related Skills

Explore More Legal & Compliance Skills→
nicolasmosquerarnicolasmosquerar
1

Secrets Externalization

Centralize hardcoded credentials in AWS Secrets Manager or Parameter Store.

Community
Advanced
mashharukimashharuki
2

aws-observability

Configure AWS CloudWatch, X-Ray, CloudTrail, and ADOT observability services.

Community
Advanced
tjl8787tjl8787

secrets-manager

Manage AWS Secrets Manager secrets with boto3 and AWS CLI.

Community
Advanced
giuseppe-trisciuogliogiuseppe-trisciuoglio
322

aws-sdk-java-v2-secrets-manager

Store and retrieve AWS Secrets Manager secrets using the Java SDK 2.x.

Community
Intermediate