Secrets Manager - Hands On

Getting hands-on with AWS Secrets Manager makes it crystal clear why this service is the enterprise favorite for managing API keys, database credentials, and high-stakes credentials. 🏎️🔐

Hands On​

Let's break down the console workflows, rotation triggers, SDK retrieval patterns, and deletion safety mechanisms into a clean recap.

🎛️ 1. Secret Creation: Key-Value vs. Native Database Integration​

Secrets Manager provides multi-structured secret creation layouts:

• Other Type of Secrets (Arbitrary Key-Value Pairs):
  • Perfect for storing external API tokens, OAuth keys, or multi-part secrets (e.g., api_key: xyz123, api_secret: abc987).
  • Stored natively as a JSON string under the hood (SecretString).
  • Custom KMS encryption key selection (AWS Managed aws/secretsmanager or a Customer Managed Key).
    
• Native Database Credentials (RDS, Aurora, DocumentDB, Redshift):
  • Asks for the target Database Username and Password.
  • The Power Play: Links directly to a provisioned RDS instance. Secrets Manager not only stores the credentials but can actively update the password inside the actual RDS engine upon rotation!
    

🔄 2. Automated Rotation Engine via Lambda​

Unlike SSM Parameter Store where rotation requires wiring up custom EventBridge rules, Secrets Manager has native scheduled rotation:

1. Schedule Configuration: Set a rotation interval (e.g., every 30, 60, or 90 days up to 1 year max).
2. Lambda Invocation: When the schedule hits, Secrets Manager automatically invokes a designated AWS Lambda function.
3. AWS Templates: AWS provides pre-built Lambda templates for standard databases (RDS MySQL, Postgres, etc.) that handle creating the new password, updating the DB user, testing the connection, and setting the new secret version seamlessly!
   

💻 3. SDK & CLI Secret Retrieval Pattern​

When your application code running in AWS (EC2, ECS, Lambda) needs the secret at runtime, it calls the GetSecretValue API action.

JavaScript Implementation Pattern:​

import {
  SecretsManagerClient,
  GetSecretValueCommand,
} from "@aws-sdk/client-secrets-manager";

const secret_name = "prod/myapp/my-secret-api";

const client = new SecretsManagerClient({
  region: "ap-southeast-2",
});

let response;

try {
  response = await client.send(
    new GetSecretValueCommand({
      SecretId: secret_name,
      VersionStage: "AWSCURRENT", // VersionStage defaults to AWSCURRENT if unspecified
    }),
  );
} catch (error) {
  // For a list of exceptions thrown, see
  // https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_GetSecretValue.html
  throw error;
}

const secret = response.SecretString;

// Your code goes here

AWS CLI Retrieval Command:​

aws secretsmanager get-secret-value \
    --secret-id prod/myapp/my-secret-api \
    --query SecretString \
    --output text

🛡️ 4. Deletion Safety: The Recovery Window​

When you delete a secret in Secrets Manager, it is NOT deleted immediately!

• Default Recovery Window: Secrets Manager forces a waiting period (minimum 7 days, maximum 30 days, defaulting to 30 days).
• Preventing Accidental Outages: During this window, the secret is marked for deletion and cannot be retrieved, but it can be easily restored if a developer realizes a production service still relied on it!
• Force Deletion: You can bypass the recovery window using the --force-delete-without-recovery flag in the CLI if you need to purge it immediately.
  

📊 5. Secrets Manager Cost Breakdown Quick Fact Sheet​

• Secret Storage: $0.40 per secret per month (prorated hourly).
• API Calls: $0.05 per 10,000 API requests (GetSecretValue).
• Optimization Strategy: Because every GetSecretValue call costs money, always use client-side caching in your application code to store retrieved secrets in memory for a few minutes instead of hammering the API on every single web request!

Exam Tips​

• The SDK Code Snippet Trap 💻: If an exam prompt presents a code snippet or question asking how to retrieve a secret payload programmatically—look for the API method GetSecretValue and extract the SecretString property from the JSON response object.
• Caching Strategy: If a scenario notes that an application's Secrets Manager API bill is unexpectedly skyrocketing due to high Lambda concurrency—choose implementing client-side secret caching (e.g., using the AWS Secrets Manager Agent or SDK Caching Libraries) to reduce API calls by over 99%.
• Cross-Account Secret Access: Sharing a secret across accounts requires an explicit Secret Resource Policy attached to the secret itself, alongside KMS key permissions!