creating-secrets-using-best-practices
aws/agent-toolkit-for-aws
Create and manage AWS Secrets Manager secrets with production-grade security controls and best practices.
What is creating-secrets-using-best-practices?
This skill automates secure secret creation in AWS Secrets Manager with built-in KMS encryption, automatic rotation, least-privilege IAM policies, CloudTrail auditing, and lifecycle management. Use it whenever you need to store sensitive credentials, API keys, OAuth tokens, or custom secrets in production environments.
- Sets up dedicated KMS encryption keys for each secret
- Configures automatic rotation for supported secret types
- Applies least-privilege IAM policies to restrict access
- Enables CloudTrail auditing for all secret operations
- Manages secret lifecycle and enforces security controls
- Supports four secret types: database credentials, API keys, OAuth tokens, and custom secrets
How to install creating-secrets-using-best-practices
npx skills add https://github.com/aws/agent-toolkit-for-aws --skill creating-secrets-using-best-practices- AWS account with Secrets Manager access
- IAM permissions for kms:CreateKey and kms:PutKeyPolicy
- Access to target systems for rotation setup (if using automatic rotation)
How to use creating-secrets-using-best-practices
- 1.Run the secret creation procedure from references/create-secrets-using-best-practices.md
- 2.Select the appropriate secret type: database credentials, API keys, OAuth tokens, or custom secrets
- 3.Provide the secret value and metadata
- 4.The skill automatically creates a dedicated KMS key with proper policies
- 5.Configure automatic rotation if applicable for your secret type
- 6.Verify CloudTrail logging is enabled for audit trails
Use cases
- Storing database credentials with automatic rotation enabled
- Creating API keys with dedicated KMS encryption and access logging
- Managing OAuth tokens with least-privilege IAM policies
- Setting up secrets for microservices with CloudTrail audit trails
- Implementing compliance-ready secret management for production workloads
- DevOps engineers managing production infrastructure
- Security teams implementing secret management policies
- AWS architects designing secure credential storage
- Development teams needing compliant secret handling
creating-secrets-using-best-practices FAQ
The IAM principal needs kms:CreateKey and kms:PutKeyPolicy permissions. The KMS key policy must grant kms:GenerateDataKey, kms:Decrypt, and kms:DescribeKey scoped with kms:ViaService to secretsmanager.<region>.amazonaws.com.
Check that the Lambda rotation function exists, has proper permissions, and can reach the target system. Review CloudWatch logs for the rotation function to identify the specific failure.
Verify the IAM policy is attached to the correct principal, the KMS key policy allows decryption and kms:GenerateDataKey, and the principal is using HTTPS for all API calls.
The skill supports four types: database credentials, API keys, OAuth tokens, and custom secrets. Each type is structured appropriately and encrypted with a dedicated KMS key.
Yes, the skill sets up CloudTrail auditing as part of the best practices configuration to log all secret operations for compliance and security monitoring.
Full instructions (SKILL.md)
Source of truth, from aws/agent-toolkit-for-aws.
name: creating-secrets-using-best-practices description: Creates and manages secrets in AWS Secrets Manager following security best practices. Always use this skill when creating secrets — it sets up dedicated KMS encryption keys, automatic rotation, least-privilege IAM policies, CloudTrail auditing, and lifecycle management that are essential for production-grade secret handling. version: 1
Creating Secrets Using Best Practices
Overview
Domain expertise for creating and managing secrets in AWS Secrets Manager with production-grade security controls: KMS encryption, automatic rotation, least-privilege IAM policies, CloudTrail auditing, and lifecycle management.
Create a secret with best practices
To create a properly secured secret in AWS Secrets Manager, follow the procedure exactly. See secret creation procedure.
The procedure supports four secret types: database credentials, API keys, OAuth tokens, and custom secrets. Each type is structured appropriately and encrypted with a dedicated KMS key.
Troubleshooting
KMS key access issues
Verify the IAM principal has kms:CreateKey and kms:PutKeyPolicy permissions, and that
the key policy grants kms:GenerateDataKey, kms:Decrypt, and kms:DescribeKey scoped
with kms:ViaService to secretsmanager.<region>.amazonaws.com. See the full procedure for details.
Rotation setup failures
Check that the Lambda rotation function exists, has proper permissions, and can reach the target system. Review CloudWatch logs for the rotation function.
Secret access denied
Verify the IAM policy is attached to the correct principal, the KMS key policy allows
decryption (and kms:GenerateDataKey for write/rotation), and the principal is using HTTPS. See the full procedure for details.
Related skills
More from aws/agent-toolkit-for-aws and the wider catalog.
debugging-lambda-timeouts
Systematically debug AWS Lambda timeout failures by analyzing configuration, logs, metrics, and dependencies.
enabling-lambda-vpc-internet-access
Enables internet access for AWS Lambda functions deployed in VPC subnets by creating NAT Gateway infrastructure, configuring public/private subnet routing, and updating security groups. Use when a VPC-attached Lambda function cannot reach the internet.
exploring-data-catalog
Full inventory and audit of AWS Glue Data Catalog, S3 Tables, Redshift-federated, and remote Iceberg catalogs.
exporting-rds-to-s3
Exports Amazon RDS or Aurora database snapshots to Amazon S3 in Apache Parquet format for analytics, backup, or data migration. Handles snapshot selection or creation, IAM role setup, KMS encryption, S3 bucket preparation, export task execution, progress monitoring, and data verification. Use when exporting RDS/Aurora data to S3 for Athena, Glue, or Redshift Spectrum consumption.
finding-data-lake-assets
Resolve data lake asset references across Glue, S3, S3 Tables, and Redshift catalogs.
ingesting-into-data-lake
Ingest data from S3, databases, Snowflake, BigQuery, DynamoDB, or Glue tables into your AWS data lake.