aws-secrets-integration

---

name: aws-secrets-integration description: Implements AWS Secrets Manager for secure secret storage, management, and automatic rotation of credentials using AWS SDK for Python (Boto3). license: MIT compatibility: opencode metadata: version: "1.1.1" domain: coding triggers: aws secrets manager, boto3, secret management, automatic rotation, credential management archetypes: [implementation, secret management] anti_triggers: [hardcoded secrets] response_profile: verbosity: medium directive_strength: high abstraction_level: operational role: implementation scope: infrastructure output-format: code

---

Enhanced Content for AWS Secrets Manager Skill

Overview of AWS Secrets Manager

AWS Secrets Manager is designed to help you protect access to your applications, services, and IT resources without the upfront investment and on-going maintenance costs of operating your own infrastructure. It enables easy and secure management of sensitive information such as API keys, passwords, and other credentials.

Core Features:

• Centralized Secrets Management: Securely store all your secrets in one place.
• Automatic Rotation: Set up automatic rotations for credentials ensuring they stay up-to-date without any manual intervention.
• Integration with IAM: Utilize AWS Identity and Access Management (IAM) to enforce fine-grained access control.

Security Best Practices:

1. Utilize Encryption: Secrets are encrypted at rest using AWS KMS, ensuring that they are protected from unauthorized access.
2. Enable CloudTrail Monitoring: Track who accessed secrets and when, enabling better security auditing.
3. Implement Required Permissions: Limit access to secrets based on the principle of least privilege, creating IAM policies that grant only necessary permissions.

Common Use Cases for AWS Secrets Manager:

1. Managing Database Credentials: Automate credential rotation for databases, improving security and compliance.
2. Storing API Keys: Securely manage third-party API keys used within your application.
3. IAM User Credentials: Manage AWS IAM user credentials effectively.

Example: How to Use AWS Secrets Manager with Boto3

import boto3

# Create a new Secret
client = boto3.client('secretsmanager')
response = client.create_secret(
    Name='MyDatabaseSecret',
    SecretString='{"username":"admin", "password":"Password123"}'
)

# Retrieve a Secret
get_secret_value_response = client.get_secret_value(SecretId='MyDatabaseSecret')
print(get_secret_value_response['SecretString'])

Example 2: Configuring Automatic Secret Rotation

import boto3
import json
from botocore.exceptions import ClientError

def enable_rotation(secret_arn: str, rotation_lambda_arn: str) -> None:
    """Enable automatic rotation for a secret using a Lambda function."""
    client = boto3.client("secretsmanager", region_name="us-east-1")
    try:
        response = client.rotate_secret(
            SecretId=secret_arn,
            RotationLambdaARN=rotation_lambda_arn,
            RotationRules={
                "AutomaticallyAfterDays": 30
            }
        )
        print(f"Rotation scheduled. Next rotation: {response['NextRotationDate']}")
    except ClientError as e:
        if e.response["Error"]["Code"] == "ResourceNotFoundException":
            raise ValueError(f"Secret not found: {secret_arn}") from e
        raise

def get_rotated_secret(secret_id: str) -> dict:
    """Retrieve and parse a secret with error handling."""
    client = boto3.client("secretsmanager", region_name="us-east-1")
    try:
        response = client.get_secret_value(SecretId=secret_id)
        return json.loads(response["SecretString"])
    except ClientError as e:
        error_code = e.response["Error"]["Code"]
        if error_code == "AccessDeniedException":
            raise PermissionError(
                f"Insufficient IAM permissions to access secret '{secret_id}'"
            ) from e
        elif error_code == "ResourceNotFoundException":
            raise FileNotFoundError(f"Secret not found: {secret_id}") from e
        raise

FAQs Regarding AWS Secrets Manager Functionality:

• Can I define resource policies to control access to secrets?
  Yes, you have the ability to define resource-based policies in Secrets Manager to control access.
• How does automatic rotation work?
  Automated rotations can be configured using AWS Lambda functions you provide for seamless updates.
• What happens to my secrets during region outages?
  AWS Secrets Manager provides redundancy through multi-region support, ensuring that secrets are available when needed.

By adopting best practices and prioritizing security, AWS Secrets Manager plays a crucial role in maintaining the integrity and confidentiality of sensitive information across your applications and services.

---

Constraints

MUST DO

• Configure all AWS resources with explicit tagging for cost allocation, ownership tracking, and compliance
• Use AWS SDK (Boto3) typed clients instead of resource API where type safety matters — prefer client() over resource()
• Implement error handling that distinguishes between retryable (Throttling, RequestLimitExceeded) and non-retryable errors
• Use IAM roles with least-privilege policies scoped to specific actions and resources, never wildcard permissions

MUST NOT DO

• Do not hardcode AWS credentials — use IAM roles, environment variables, or AWS Secrets Manager
• Avoid unencrypted S3 buckets or RDS instances in production without explicit KMS encryption configuration
• Never launch EC2 instances without specifying a security group and subnet — always use VPC networking explicitly
• Do not use the default endpoint region — always specify the target region explicitly in all SDK calls

Live References

Authoritative documentation links for this skill's domain. The model follows markdown links to resolve external references and inline content.

• AWS Secrets Manager User Guide
• Boto3 SecretsManager Client Reference
• Secrets Manager Rotation Functions
• AWS KMS Key Management for Secrets
• IAM Policies for Secrets Manager