aws-secretsmanager

Create a new secret

$ aws secretsmanager create-secret --name [secret-name] --secret-string "[secret-value]"

$ aws secretsmanager get-secret-value --secret-id [secret-name]

$ aws secretsmanager list-secrets

$ aws secretsmanager put-secret-value --secret-id [secret-name] --secret-string "[new-value]"

$ aws secretsmanager delete-secret --secret-id [secret-name] --recovery-window-in-days [7]

$ aws secretsmanager delete-secret --secret-id [secret-name] --force-delete-without-recovery

$ aws secretsmanager rotate-secret --secret-id [secret-name]

$ aws secretsmanager get-random-password --password-length [32]

aws secretsmanager subcommand [options]

aws secretsmanager is the AWS CLI interface for Amazon Secrets Manager, a service for securely storing, managing, and retrieving secrets such as database credentials, API keys, and other sensitive information.
Secrets Manager enables automatic rotation of secrets, fine-grained access control through IAM policies, and audit logging via CloudTrail. It supports replication across regions for disaster recovery.

Secret Management

create-secret, delete-secret, describe-secret, get-secret-value, put-secret-value, update-secret, restore-secret

list-secrets, list-secret-version-ids

rotate-secret, cancel-rotate-secret

replicate-secret-to-regions, remove-regions-from-replication, stop-replication-to-replica

get-resource-policy, put-resource-policy, delete-resource-policy, validate-resource-policy

tag-resource, untag-resource

get-random-password, batch-get-secret-value, update-secret-version-stage

Deleted secrets enter a recovery window (default 30 days) before permanent deletion; use --force-delete-without-recovery to skip this. Secret values have a 64KB size limit. Automatic rotation requires a Lambda function. Secrets Manager charges per secret per month plus per API call.

AWS Secrets Manager was launched in April 2018 to provide a centralized secrets management service with built-in rotation capabilities. It replaced ad-hoc solutions like storing secrets in environment variables, configuration files, or Parameter Store.

aws(1), aws-ssm(1), vault(1)