AutoGineer
Generated banner for Creating Secrets Using Best Practices
Generated logo for Creating Secrets Using Best Practices

Creating Secrets Using Best Practices

AWSOfficialPublished by AWS

  • Skill
  • Workflow
  • Cloud and DevOps
  • Apache-2.0
  • No issues found
Download ZIP

From the author

Creates and manages secrets in AWS Secrets Manager following security best practices. Always use this skill when creating secrets — it sets up dedicated KMS encryption keys, automatic rotation, least-privilege IAM policies, CloudTrail auditing, and lifecycle management that are essential for production-grade secret handling.
— the description by AWS

AutoGineer summary

Written by AutoGineer from the skill’s own files, not by the author

This skill provides a standardized workflow for deploying secrets within AWS Secrets Manager. It enforces the use of dedicated KMS encryption keys, automatic rotation, and least-privilege IAM policies. The process includes verification of environment dependencies, KMS key setup with restricted service-linked access, and secret creation tailored to specific types such as database credentials, API keys, or OAuth tokens.

What it does

  • Verifies AWS environment configuration and tool dependencies.
  • Creates or validates dedicated KMS keys for secret encryption.
  • Configures KMS key policies with service-linked access restrictions.
  • Implements automatic secret rotation with configurable intervals.
  • Applies least-privilege IAM policies to control secret access.
  • Manages secret lifecycle through tagging and recovery window settings.

When to use it

  • When deploying new secrets to AWS Secrets Manager for production environments.
  • When you need to ensure secrets are encrypted with dedicated, managed KMS keys.
  • When you require automated rotation for database credentials or API keys.
  • When you need to enforce consistent security tagging and access policies for secrets.

Advantages

  • Ensures consistent application of security best practices across all secrets.
  • Reduces manual configuration errors by following a defined SOP.
  • Centralizes secret lifecycle management including rotation and deletion.
  • Enforces strict access control through integrated IAM and KMS policy management.

Usage examples

“Create a new database secret named prod-db-creds in us-east-1.”
The agent will prompt for the required parameters, including the secret value, rotation interval, and allowed principals, before executing the creation workflow.
“Set up an API key secret using my existing KMS key.”
The agent will verify the provided KMS key's accessibility and policy before creating the secret in AWS Secrets Manager.

Install

  1. Download the skill as a ZIP:

    https://mp-staging.autogineer.com/agent-skills/aws/creating-secrets-using-best-practices/download

  2. Unzip it into the cross-client skills folder of your project:

    mkdir -p .agents/skills && unzip creating-secrets-using-best-practices.zip -d .agents/skills

Documentation by AWS

Creating Secrets Using Best Practices

Overview

Domain expertise for creating and managing secrets in AWS Secrets Manager with production-grade security controls: KMS encryption, automatic rotation, least-privilege IAM policies, CloudTrail auditing, and lifecycle management.

Create a secret with best practices

To create a properly secured secret in AWS Secrets Manager, follow the procedure exactly. See secret creation procedure.

The procedure supports four secret types: database credentials, API keys, OAuth tokens, and custom secrets. Each type is structured appropriately and encrypted with a dedicated KMS key.

Troubleshooting

KMS key access issues

Verify the IAM principal has kms:CreateKey and kms:PutKeyPolicy permissions, and that the key policy grants kms:GenerateDataKey, kms:Decrypt, and kms:DescribeKey scoped with kms:ViaService to secretsmanager.<region>.amazonaws.com. See the full procedure for details.

Rotation setup failures

Check that the Lambda rotation function exists, has proper permissions, and can reach the target system. Review CloudWatch logs for the rotation function.

Secret access denied

Verify the IAM policy is attached to the correct principal, the KMS key policy allows decryption (and kms:GenerateDataKey for write/rotation), and the principal is using HTTPS. See the full procedure for details.

Files

Requirements and compatibility

Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta

“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.

Needs: Needs an API key

Security

No issues found by our static scan· No issues found

A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.

Attribution and licence

Published by
AWS
Publisher
AWS (Official)
Source
aws/agent-toolkit-for-aws · skills/specialized-skills/security-and-identity-skills/creating-secrets-using-best-practices · commit 0a218f8
Licence
Apache License 2.0 (redistribution allowed)
  • LICENSE (added by AutoGineer from LICENSE)
  • NOTICE (added by AutoGineer from NOTICE)
  • ATTRIBUTION.md (written by AutoGineer)
Synced

AutoGineer is not affiliated with or endorsed by AWS.

Download ZIP

The ZIP holds the skill’s files, its licence files and an ATTRIBUTION.md. Download creating-secrets-using-best-practices.zip