Creating Secrets Using Best Practices

This handles the full security setup for AWS Secrets Manager so you don't have to remember all the pieces. It creates dedicated KMS encryption keys for each secret, configures automatic rotation, sets up least-privilege IAM policies, and enables CloudTrail auditing. Supports database credentials, API keys, OAuth tokens, and custom secrets. The main value is that it bundles together all the production-grade controls that are easy to forget when you're just trying to store a secret quickly. If you're managing secrets in AWS and want to avoid the "we'll add proper encryption later" trap, this gets you there immediately.

skills.sh installs: 7.2K
GitHub stars: 3.4K
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add aws/agent-toolkit-for-aws --skill creating-secrets-using-best-practices --agent claude-code

Installs into .claude/skills of the current project.

Files

Creating Secrets Using Best Practices

Overview

Domain expertise for creating and managing secrets in AWS Secrets Manager with production-grade security controls: KMS encryption, automatic rotation, least-privilege IAM policies, CloudTrail auditing, and lifecycle management.

Create a secret with best practices

To create a properly secured secret in AWS Secrets Manager, follow the procedure exactly. See secret creation procedure.

The procedure supports four secret types: database credentials, API keys, OAuth tokens, and custom secrets. Each type is structured appropriately and encrypted with a dedicated KMS key.

Troubleshooting

KMS key access issues

Verify the IAM principal has kms:CreateKey and kms:PutKeyPolicy permissions, and that the key policy grants kms:GenerateDataKey, kms:Decrypt, and kms:DescribeKey scoped with kms:ViaService to secretsmanager.<region>.amazonaws.com. See the full procedure for details.

Rotation setup failures

Check that the Lambda rotation function exists, has proper permissions, and can reach the target system. Review CloudWatch logs for the rotation function.

SKILL.md on GitHub