aws-secrets

Create a new secret

$ aws secretsmanager create-secret --name [secret_name] --secret-string "[secret_value]"

$ aws secretsmanager get-secret-value --secret-id [secret_name]

$ aws secretsmanager list-secrets

$ aws secretsmanager put-secret-value --secret-id [secret_name] --secret-string "[new_value]"

$ aws secretsmanager delete-secret --secret-id [secret_name] --recovery-window-in-days [30]

$ aws secretsmanager delete-secret --secret-id [secret_name] --force-delete-without-recovery

$ aws secretsmanager restore-secret --secret-id [secret_name]

$ aws secretsmanager rotate-secret --secret-id [secret_name]

aws secretsmanager command [options]

AWS Secrets Manager is a service for securely storing and managing sensitive information like database credentials, API keys, and passwords. The aws secretsmanager commands provide CLI access to create, retrieve, rotate, and manage secrets.
Secrets are encrypted at rest using AWS KMS and can be automatically rotated on a schedule using Lambda functions. Access is controlled through IAM policies, and all access is logged to CloudTrail for auditing.
Secrets can store strings up to 64KB, supporting JSON for structured data like database credentials. Applications retrieve secrets at runtime, eliminating hardcoded credentials in code or configuration files.

create-secret

Create a new secret.

Retrieve the encrypted value of a secret.

List secrets in the account.

Store a new value for an existing secret.

Update secret metadata or value.

Mark a secret for deletion.

Restore a previously deleted secret.

Trigger secret rotation.

Get metadata about a secret.

Secret name or ARN.

Secret value as a string.

Secret value as base64-encoded binary.

KMS key for encryption (optional).

Waiting period before permanent deletion (7-30 days).

Retrieving secrets incurs per-request charges. Deleted secrets have a recovery window by default; use --force-delete-without-recovery cautiously. Automatic rotation requires a configured Lambda function. Cross-region replication requires explicit configuration. Secrets Manager is separate from Systems Manager Parameter Store (another secrets option).

AWS Secrets Manager was launched in April 2018 to address the challenge of managing application secrets securely. It was built on lessons learned from AWS Systems Manager Parameter Store, adding features like automatic rotation, cross-region replication, and native integration with RDS, Redshift, and DocumentDB for credential management.

aws(1), vault(1), aws-vault(1)