# Secrets Manager

AWS Secrets Manager for secure secret storage and rotation.

- Repository: https://github.com/itsmostafa/aws-agent-skills (1171 stars)
- Category: DevOps
- License: MIT
- Last updated: 2026-10-26
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add itsmostafa/aws-agent-skills --skill secrets-manager -g -a claude-code -y`
Codex: `npx skills add itsmostafa/aws-agent-skills --skill secrets-manager -g -a codex -y`
Cursor: `npx skills add itsmostafa/aws-agent-skills --skill secrets-manager -g -a cursor -y`
Gemini CLI: `npx skills add itsmostafa/aws-agent-skills --skill secrets-manager -g -a gemini-cli -y`
Claude Code plugin marketplace: `/plugin marketplace add itsmostafa/aws-agent-skills`

## Description

AWS Secrets Manager for secure secret storage and rotation. Use when storing credentials, configuring automatic rotation, managing secret versions, retrieving secrets in applications, or integrating with RDS.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# AWS Secrets Manager

AWS Secrets Manager helps protect access to applications, services, and IT resources. Store, retrieve, and automatically rotate credentials, API keys, and other secrets.

## Table of Contents

- [Core Concepts](#core-concepts)
- [Common Patterns](#common-patterns)
- [CLI Reference](#cli-reference)
- [Best Practices](#best-practices)
- [Troubleshooting](#troubleshooting)
- [References](#references)

## Core Concepts

### Secrets

Encrypted data stored in Secrets Manager. Can contain:
- Database credentials
- API keys
- OAuth tokens
- Any key-value pairs (up to 64 KB)

### Versions

Each secret can have multiple versions:
- **AWSCURRENT**: Current active version
- **AWSPENDING**: Version being rotated to
- **AWSPREVIOUS**: Previous version

### Rotation

Automatic credential rotation using Lambda functions. Built-in support for:
- Amazon RDS
- Amazon Redshift
- Amazon DocumentDB
- Custom secrets

## Common Patterns

### Create a Secret

**AWS CLI:**

```bash
# Create secret with JSON
aws secretsmanager create-secret \
  --name prod/myapp/database \
  --description "Production database credentials" \
  --secret-string '{"username":"admin","password":"MySecurePassword123!","host":"mydb.cluster-xyz.us-east-1.rds.amazonaws.com","port":5432,"database":"myapp"}'

# Create secret with binary data
aws secretsmanager create-secret \
  --name prod/myapp/certificate \
  --secret-binary fileb://certificate.pem
```

**boto3:**

```python
import boto3
import json

secrets = boto3.client('secretsmanager')

The rest: https://github.com/itsmostafa/aws-agent-skills/blob/HEAD/skills/secrets-manager/SKILL.md