AWS Secrets Manager: Rotation, IAM Scoping, and Production Gotchas

Day 17: AWS Secrets Manager

Secrets Manager charges $0.40/secret/month but gives you something Parameter Store does not: automatic credential rotation with pre-built Lambda functions for RDS, Redshift, and DocumentDB.

Retrieving Secrets in Go

package main

import (
    "context"
    "encoding/json"
    "fmt"
    "github.com/aws/aws-sdk-go-v2/config"
    "github.com/aws/aws-sdk-go-v2/service/secretsmanager"
)

type DBCreds struct {
    Username string `json:"username"`
    Password string `json:"password"`
    Host     string `json:"host"`
}

func getSecret(ctx context.Context, name string) (*DBCreds, error) {
    cfg, _ := config.LoadDefaultConfig(ctx, config.WithRegion("us-east-1"))
    client := secretsmanager.NewFromConfig(cfg)
    result, err := client.GetSecretValue(ctx, &secretsmanager.GetSecretValueInput{
        SecretId: &name,
    })
    if err != nil {
        return nil, fmt.Errorf("failed to retrieve secret: %w", err)
    }
    var creds DBCreds
    json.Unmarshal([]byte(*result.SecretString), &creds)
    return &creds, nil
}

Key Tips

• Name secrets as env/app/purpose for clean IAM wildcard scoping
• Always pin the AWS region -- cross-region secret injection is a real attack
• Rotation Lambda needs VPC + NAT gateway access to reach RDS
• Cache secrets in-app (1hr TTL default) to reduce costs
• Cross-account access needs BOTH a resource policy AND a KMS key grant

Tomorrow: AWS Systems Manager and Parameter Store.