skilld
All skills
aws avatar

/creating-secrets-using-best-practices

@803cbf4
by Amazon Web Servicesaws/agent-toolkit-for-aws2.8k stars
337

Creates and manages secrets in AWS Secrets Manager following security best practices. Always use this skill when creating secrets — it sets up dedicated KMS encryption keys, automatic rotation, least-privilege IAM policies, CloudTrail auditing, and lifecycle management that are essential for production-grade secret handling.

Ask your Agent

Use this Skill: https://skilld.dev/gh/aws/agent-toolkit-for-aws/creating-secrets-using-best-practices

This session only. Nothing lands on disk.

SKILL.md

≈92 tokens always: the name and description. ≈360 when used: this file. ≈2.5k more on demand in 1 file.

Creating Secrets Using Best Practices

Overview

Domain expertise for creating and managing secrets in AWS Secrets Manager with production-grade security controls: KMS encryption, automatic rotation, least-privilege IAM policies, CloudTrail auditing, and lifecycle management.

Create a secret with best practices

To create a properly secured secret in AWS Secrets Manager, follow the procedure exactly. See secret creation procedure.

The procedure supports four secret types: database credentials, API keys, OAuth tokens, and custom secrets. Each type is structured appropriately and encrypted with a dedicated KMS key.

Troubleshooting

KMS key access issues

Verify the IAM principal has kms:CreateKey and kms:PutKeyPolicy permissions, and that the key policy grants kms:GenerateDataKey, kms:Decrypt, and kms:DescribeKey scoped with kms:ViaService to secretsmanager.<region>.amazonaws.com. See the full procedure for details.

Rotation setup failures

Check that the Lambda rotation function exists, has proper permissions, and can reach the target system. Review CloudWatch logs for the rotation function.

Secret access denied

Verify the IAM policy is attached to the correct principal, the KMS key policy allows decryption (and kms:GenerateDataKey for write/rotation), and the principal is using HTTPS. See the full procedure for details.

Source: SKILL.md on GitHub

Third-party checks

2 warnings16d3 checks · Risk SAFE
  • Gen Agent Trust Hub16d

    This skill facilitates the management of AWS Secrets Manager resources using security best practices, such as dedicated KMS encryption and automatic rotation. It includes a security consideration regarding the ingestion of configuration parameters from external URLs, which warrants review to ensure data sources are trusted.

  • Socket16d

    1 alert: gptSecurity

  • Snyk16d

    Risk: MEDIUM · 1 issue

Provenance

Signed by skilld at 803cbf4. This ties the file your Agent reads to that commit on GitHub. It does not review the instructions.

Last checked against GitHub yesterday.

Activeupdated 5 months ago

Capability

version
1

README badge

README badge for aws/agent-toolkit-for-aws/creating-secrets-using-best-practices