Day 17: AWS Secrets Manager

Secrets Manager charges $0.40/secret/month but gives you something Parameter Store does not: automatic credential rotation with pre-built Lambda functions for RDS, Redshift, and DocumentDB.

Retrieving Secrets in Go 

package main import ( "context" "encoding/json" "fmt" "github.com/aws/aws-sdk-go-v2/config" "github.com/aws/aws-sdk-go-v2/service/secretsmanager" ) type DBCreds struct { Username string `json:"username"` Password string `json:"password"` Host string `json:"host"` } func getSecret(ctx context.Context, name string) (*DBCreds, error) { cfg, _ := config.LoadDefaultConfig(ctx, config.WithRegion("us-east-1")) client := secretsmanager.NewFromConfig(cfg) result, err := client.GetSecretValue(ctx, &secretsmanager.GetSecretValueInput{ SecretId: &name, }) if err != nil { return nil, fmt.Errorf("failed to retrieve secret: %w", err) } var creds DBCreds json.Unmarshal([]byte(*result.SecretString), &creds) return &creds, nil }

Key Tips

  • Name secrets as env/app/purpose for clean IAM wildcard scoping
  • Always pin the AWS region -- cross-region secret injection is a real attack
  • Rotation Lambda needs VPC + NAT gateway access to reach RDS
  • Cache secrets in-app (1hr TTL default) to reduce costs
  • Cross-account access needs BOTH a resource policy AND a KMS key grant

Tomorrow: AWS Systems Manager and Parameter Store.