AWS - Secrets

AWS Secrets Manager helps you manage, retrieve, and rotate database credentials, application credentials, OAuth tokens, API keys, and other secrets throughout their lifecycles.

In Secrets Manager, a secret consists of secret information, the secret value, plus metadata about the secret. A secret value can be a string or binary. 

Let's start with creating a simple secret and how to view using a Python program.

Here my secret is going to be a simple key: value pair.

To access the secret, I have created an IAM Role and "RoleToRetrieveSecretAtRuntime” with permission to “GetSecretValue”.

Updating the secret's access policy.

The above permission states role "RoleToRetrieveSecretAtRuntime" can perform "GetSecretValue".

We are done with the secret part. Now, We are going to use a Python program to view the secret from an EC2 instance. 

NOTE: EC2 instance should be attached with the role RoleToRetrieveSecretAtRuntime

import boto3

from botocore.exceptions import ClientError

def get_secret():

    secret_name = "DemoSecret"

    region_name = "us-east-1"

    # Create a Secrets Manager client

    session = boto3.session.Session()

    client = session.client(

        service_name='secretsmanager',

        region_name=region_name

    )

    try:

        get_secret_value_response = client.get_secret_value(

            SecretId=secret_name

        )

    except ClientError as e:

        # For a list of exceptions thrown, see

        # https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_GetSecretValue.html

        raise e

    # Decrypts secret using the associated KMS key.

    secret = get_secret_value_response['SecretString']

    print(secret);

get_secret();

I modified the code to print the secret values.

Now,  We are able to view secret that we created.