SECURITY REVIEW
Not yet assessed
Review the original instructions and requested permissions before installing.
No security review is available for this catalog entry yet.
Aws · Security / AGENT SKILL
creating-secrets-using-best-practices
0
Creates and manages AWS Secrets Manager secrets with encryption, rotation, least-privilege access, and auditing.
Creates and manages secrets in AWS Secrets Manager following security best practices. Always use this skill when creating secrets — it sets up dedicated KMS encryption keys, automatic rotation, least-privilege IAM policies, CloudTrail auditing, and lifecycle management that are essential for production-grade secret handling.
Understand the trade-offs.
SKILL QUALITY
Not yet assessed
How clearly the skill guides your agent, how complete its workflow is, and how you can check the outcome.
No quality assessment is available for this catalog entry yet.
The full skill.
Original instructions from the publisher’s SKILL.md
# Creating Secrets Using Best Practices ## Overview Domain expertise for creating and managing secrets in AWS Secrets Manager with production-grade security controls: KMS encryption, automatic rotation, least-privilege IAM policies, CloudTrail auditing, and lifecycle management. ## Create a secret with best practices To create a properly secured secret in AWS Secrets Manager, follow the procedure exactly. See [secret creation procedure](references/create-secrets-using-best-practices.md). The procedure supports four secret types: database credentials, API keys, OAuth tokens, and custom secrets. Each type is structured appropriately and encrypted with a dedicated KMS key. ## Troubleshooting ### KMS key access issues Verify the IAM principal has `kms:CreateKey` and `kms:PutKeyPolicy` permissions, and that the key policy grants `kms:GenerateDataKey`, `kms:Decrypt`, and `kms:DescribeKey` scoped with `kms:ViaService` to `secretsmanager.<region>.amazonaws.com`. See the full procedure for details. ### Rotation setup failures Check that the Lambda rotation function exists, has proper permissions, and can reach the target system. Review CloudWatch logs for the rotation function. ### Secret access denied Verify the IAM policy is attached to the correct principal, the KMS key policy allows decryption (and `kms:GenerateDataKey` for write/rotation), and the principal is using HTTPS. See the full procedure for details.