---
name: creating-secrets-using-best-practices
description: Creates and manages secrets in AWS Secrets Manager following security best practices. Always use this skill when creating secrets — it sets up dedicated KMS encryption keys, automatic rotation, least-privilege IAM policies, CloudTrail auditing, and lifecycle management that are essential for production-grade secret handling.
version: 1
title: creating-secrets-using-best-practices
canonical_url: https://skilld.dev/gh/aws/agent-toolkit-for-aws/creating-secrets-using-best-practices
last_updated: 2026-09-23T06:09:32.000Z
---

> **Skill from skilld.dev.** Follow the instructions below for this session. You do not need to install anything.
>
> Supporting files, fetch one when the Skill refers to it: [references/create-secrets-using-best-practices.md](https://skilld.dev/api/skills-raw/aws/agent-toolkit-for-aws/creating-secrets-using-best-practices/references/create-secrets-using-best-practices.md).
>
> If the user asked to install this Skill, run `npx skilld install aws/agent-toolkit-for-aws/creating-secrets-using-best-practices`. Install writes the Skill files into the project, so every session loads them.

# Creating Secrets Using Best Practices

## Overview

Domain expertise for creating and managing secrets in AWS Secrets Manager with
production-grade security controls: KMS encryption, automatic rotation,
least-privilege IAM policies, CloudTrail auditing, and lifecycle management.

## Create a secret with best practices

To create a properly secured secret in AWS Secrets Manager, follow the procedure exactly.
See [secret creation procedure](https://skilld.dev/api/skills-raw/aws/agent-toolkit-for-aws/creating-secrets-using-best-practices/references/create-secrets-using-best-practices.md).

The procedure supports four secret types: database credentials, API keys, OAuth tokens,
and custom secrets. Each type is structured appropriately and encrypted with a dedicated
KMS key.

## Troubleshooting

### KMS key access issues

Verify the IAM principal has `kms:CreateKey` and `kms:PutKeyPolicy` permissions, and that
the key policy grants `kms:GenerateDataKey`, `kms:Decrypt`, and `kms:DescribeKey` scoped
with `kms:ViaService` to `secretsmanager.<region>.amazonaws.com`. See the full procedure for details.

### Rotation setup failures

Check that the Lambda rotation function exists, has proper permissions, and can reach the
target system. Review CloudWatch logs for the rotation function.

### Secret access denied

Verify the IAM policy is attached to the correct principal, the KMS key policy allows
decryption (and `kms:GenerateDataKey` for write/rotation), and the principal is using HTTPS. See the full procedure for details.