🔑
Security

AWS Secrets Manager

Store and rotate passwords, API keys, and database credentials in AWS

🐧 Linux🍎 Mac🪟 Windows
Reviewed: Tested on: Kubernetes 1.29 · Terraform 1.8 · Ubuntu 22.04

Alternative — team standard for Secrets management

Recommended: Vault →Recommended: External Secrets Operator →

What is this?

AWS Secrets Manager stores passwords and API keys with automatic rotation and IAM access control.

📥

Step 01

Install AWS Secrets Manager

(01)Install AWS Secrets Manager

Linux
1sudo apt-get install -y awscli && aws configure
⚙️

Step 02

Configure AWS Secrets Manager

(01)Configure AWS Secrets Manager

Linux
1aws secretsmanager create-secret \
2  --name prod/myapp/db \
3  --description "Database credentials" \
4  --secret-string '{"username":"admin","password":"CHANGE_ME"}'
5 
6aws secretsmanager get-secret-value --secret-id prod/myapp/db
✅

Step 03

Verify

(01)Verify installation

Linux
1aws secretsmanager list-secrets
2aws secretsmanager describe-secret --secret-id prod/myapp/db
⚡

Step 04

Manage AWS Secrets Manager

(01)Common tasks

Linux
1aws secretsmanager rotate-secret --secret-id prod/myapp/db
2aws secretsmanager delete-secret --secret-id prod/myapp/db --force-delete-without-recovery
🔧

Step 05

Common Problems

#1AccessDeniedException when reading secret

Linux
1aws sts get-caller-identity
2aws iam simulate-principal-policy \
3  --policy-source-arn $(aws sts get-caller-identity --query Arn --output text) \
4  --action-names secretsmanager:GetSecretValue \
5  --resource-arns arn:aws:secretsmanager:region:account:secret:prod/myapp/db-*

📋Config templates

1 YAML template for AWS Secrets Manager. Copy and deploy after setup.

1 ready-to-copy template. Expand one, copy the YAML, then run the deploy commands.

secret-store.yml

yaml
1apiVersion: external-secrets.io/v1beta1
2kind: SecretStore
3metadata:
4  name: aws-secrets
5  namespace: default
6spec:
7  provider:
8    aws:
9      service: SecretsManager
10      region: us-east-1

external-secret.yml

yaml
1apiVersion: external-secrets.io/v1beta1
2kind: ExternalSecret
3metadata:
4  name: app-db-credentials
5  namespace: default
6spec:
7  refreshInterval: 1h
8  secretStoreRef:
9    name: aws-secrets
10    kind: SecretStore
11  target:
12    name: db-credentials
13    creationPolicy: Owner
14  data:
15    - secretKey: password
16      remoteRef:
17        key: prod/myapp/db
18        property: password
📄

Step 01

Apply ExternalSecret

(01)Deploy to cluster

Linux
1kubectl apply -f .
2kubectl get all
3kubectl get pods -w

(02)Remove

Linux
1kubectl delete -f .