Creating Secrets Using Best Practices
Creates and manages secrets in AWS Secrets Manager following security best practices. Always use this skill when creating secrets — it sets up dedicated KMS encryption keys, automatic rotation, least-privilege IAM policies, CloudTrail auditing, and lifecycle management that are essential for production-grade secret handling.
- Skill ID
- aws/agent-toolkit-for-aws/creating-secrets-using-best-practices
- Publisher
- aws
- Repository
- agent-toolkit-for-aws
- Installs
- 0
- Files
- 2
- Synced
- Sep 23, 2026
Open any RiverX project, open the Skills panel in the chat, and search for this identifier. The files are fetched from the source repository at install time.
aws/agent-toolkit-for-aws/creating-secrets-using-best-practicesInstalls these files- SKILL.md
- references/create-secrets-using-best-practices.md
What this skill tells the agent
Creating Secrets Using Best Practices
Overview
Domain expertise for creating and managing secrets in AWS Secrets Manager with production-grade security controls: KMS encryption, automatic rotation, least-privilege IAM policies, CloudTrail auditing, and lifecycle management.
Create a secret with best practices
To create a properly secured secret in AWS Secrets Manager, follow the procedure exactly. See secret creation procedure.
The procedure supports four secret types: database credentials, API keys, OAuth tokens, and custom secrets. Each type is structured appropriately and encrypted with a dedicated KMS key.
Troubleshooting
KMS key access issues
Verify the IAM principal has kms:CreateKey and kms:PutKeyPolicy permissions, and that the key policy grants kms:GenerateDataKey, kms:Decrypt, and kms:DescribeKey scoped with kms:ViaService to secretsmanager.<region>.amazonaws.com. See the full procedure for details.
Rotation setup failures
Check that the Lambda rotation function exists, has proper permissions, and can reach the target system. Review CloudWatch logs for the rotation function.
Secret access denied
Verify the IAM policy is attached to the correct principal, the KMS key policy allows decryption (and kms:GenerateDataKey for write/rotation), and the principal is using HTTPS. See the full procedure for details.
More from aws
Use this skill in a project
Open any RiverX project, search the Skills panel for aws/agent-toolkit-for-aws/creating-secrets-using-best-practices, and install it in one click.