mcpField
C
creating-secrets-using-best-practices

creating-secrets-using-best-practices

github.com/awsSecurity3.3k6.8k installsUpdated today
Repository

About creating-secrets-using-best-practices

creating-secrets-using-best-practices is a skill for creating and managing secrets in AWS Secrets Manager with security controls. It covers common secret types, KMS encryption, rotation, IAM permissions, auditing, and lifecycle management.

Key features

  1. 01Structure database, API, OAuth, and custom secrets
  2. 02Encrypt secrets with dedicated KMS keys
  3. 03Configure automatic rotation
  4. 04Apply least-privilege IAM policies
  5. 05Support CloudTrail auditing and lifecycle management

Use cases

  1. 01Create a secured database credential secret
  2. 02Store API keys or OAuth tokens
  3. 03Set up secret rotation
  4. 04Troubleshoot KMS, rotation, or access issues

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/aws/agent-toolkit-for-aws --skill creating-secrets-using-best-practices

After installing, type/creating-secrets-using-best-practicesin Claude Code to confirm it loaded.

Bundled filesreferences/create-secrets-using-best-practices.md

Details

From the project README

Creating Secrets Using Best Practices

Overview

Domain expertise for creating and managing secrets in AWS Secrets Manager with production-grade security controls: KMS encryption, automatic rotation, least-privilege IAM policies, CloudTrail auditing, and lifecycle management.

Create a secret with best practices

To create a properly secured secret in AWS Secrets Manager, follow the procedure exactly. See secret creation procedure.

The procedure supports four secret types: database credentials, API keys, OAuth tokens, and custom secrets. Each type is structured appropriately and encrypted with a dedicated KMS key.

Troubleshooting

KMS key access issues

Verify the IAM principal has kms:CreateKey and kms:PutKeyPolicy permissions, and that the key policy grants kms:GenerateDataKey, kms:Decrypt, and kms:DescribeKey scoped with kms:ViaService to secretsmanager.<region>.amazonaws.com. See the full procedure for details.

Rotation setup failures

Check that the Lambda rotation function exists, has proper permissions, and can reach the target system. Review CloudWatch logs for the rotation function.

Secret access denied

Verify the IAM policy is attached to the correct principal, the KMS key policy allows decryption (and kms:GenerateDataKey for write/rotation), and the principal is using HTTPS. See the full procedure for details.

Comments

Markdown supported