creating-secrets-using-best-practices

What problem does it solve? Manually provisioning secrets in AWS often skips critical security controls like dedicated KMS keys, automatic rotation, and scoped IAM policies, leaving credentials exposed. This Skill walks you through a complete, security-first procedure for creating secrets in AWS Secrets Manager so nothing important is missed. ## Core Features & Use Cases - Structured Secret Creation: Supports four secret types — database credentials, API keys, OAuth tokens, and custom secrets — each stored in the appropriate JSON structure and encrypted with a dedicated KMS key. - Automatic Rotation & Lifecycle Management: Configures rotation intervals, Lambda rotation functions, recovery windows, and tagging for safe secret lifecycle handling. - Auditing & Least-Privilege Access: Sets up CloudTrail logging, CloudWatch alarms for suspicious access, and read-only IAM policies scoped to specific secret and key ARNs with HTTPS enforcement. - Use Case: You need to store production database credentials for a new application. The Skill creates the secret with a dedicated KMS key, enables 30-day automatic rotation, attaches a least-privilege read policy, and validates retrieval end to end. ## Quick Start Ask the agent to create a new database secret named prod-database-credentials in us-east-1 with automatic 30-day rotation and production tags following security best practices.