What problem does it solve? Manually creating secrets in AWS Secrets Manager often skips critical security controls like dedicated KMS encryption, automatic rotation, and least-privilege access, leaving credentials exposed. This Skill walks through a complete, security-first procedure so every secret is created with production-grade protections from the start. ## Core Features & Use Cases - Secure Secret Creation: Creates database credentials, API keys, OAuth tokens, and custom secrets encrypted with a dedicated KMS key whose policy is scoped to Secrets Manager via the kms:ViaService condition. - Automatic Rotation & IAM: Configures automatic rotation with AWS-managed or custom Lambda functions and generates least-privilege IAM policies scoped to specific secret and key ARNs with HTTPS enforcement. - Auditing & Lifecycle Management: Verifies CloudTrail logging, sets up CloudWatch alarms for failed retrievals and rotation failures, and applies tagging and recovery windows. - Use Case: A DevOps engineer needs to store production database credentials. The Skill creates the secret as structured JSON, provisions a dedicated KMS key, enables 30-day rotation, attaches a read-only IAM policy, and validates the entire setup. ## Quick Start Create a new database secret named prod-database-credentials in us-east-1 with automatic rotation enabled and tags for Environment and Owner.
