Questions? hello@viberation.devGet supportBlogDocsChangelog

Colour mode

XGitHub
Get started

AWS Secrets Best Practices

Skills#backend

Create secrets in AWS Secrets Manager the secure way.

From the AWS agent toolkit. Your agent creates and manages secrets in AWS Secrets Manager following security best practices, including dedicated encryption keys.

Install this skill

npx skills add https://github.com/aws/agent-toolkit-for-aws --skill creating-secrets-using-best-practices

Runs the open-source skills CLI in your own terminal. It asks which agents to add the skill to. Read what it tells your agent to do before you install it.

Download skill (.zip)

Install for your agent

  • Claude Code

    Run this in your project

    npx skills add https://github.com/aws/agent-toolkit-for-aws --skill creating-secrets-using-best-practices -a claude-code

    Add -g to install it for every project instead.

    Or ask Claude Code to do it

    Install the "creating-secrets-using-best-practices" skill from https://github.com/aws/agent-toolkit-for-aws for Claude Code.
Copy the skill folder (the one containing SKILL.md, with any scripts or reference files next to it) into .claude/skills/ in this project.
Before copying, show me the SKILL.md and list any scripts it includes, and wait for me to confirm.

    Or copy the folder yourself

    Unzip the download into .claude/skills/ for this project, or ~/.claude/skills/ for all your projects.

    Picked up in the current session, no restart needed.

    Claude Code skills docs
  • Claude.aiNot supported

    This skill is marked as not working in Claude.ai, usually because it needs a terminal or files that Claude.ai does not have.

    Claude.ai skills docs
  • ChatGPTNot supported

    This skill is marked as not working in ChatGPT, usually because it needs a terminal or files that ChatGPT does not have.

    ChatGPT skills docs
  • Codex

    Run this in your project

    npx skills add https://github.com/aws/agent-toolkit-for-aws --skill creating-secrets-using-best-practices -a codex

    Add -g to install it for every project instead.

    Or ask Codex to do it

    Install the "creating-secrets-using-best-practices" skill from https://github.com/aws/agent-toolkit-for-aws for Codex.
Copy the skill folder (the one containing SKILL.md, with any scripts or reference files next to it) into .agents/skills/ in this project.
Before copying, show me the SKILL.md and list any scripts it includes, and wait for me to confirm.

    Or copy the folder yourself

    Unzip the download into .agents/skills/ for this project, or ~/.agents/skills/ for all your projects.

    Restart Codex if the skill does not show up.

    Codex skills docs
  • Cursor

    Run this in your project

    npx skills add https://github.com/aws/agent-toolkit-for-aws --skill creating-secrets-using-best-practices -a cursor

    Add -g to install it for every project instead.

    Or ask Cursor to do it

    Install the "creating-secrets-using-best-practices" skill from https://github.com/aws/agent-toolkit-for-aws for Cursor.
Copy the skill folder (the one containing SKILL.md, with any scripts or reference files next to it) into .cursor/skills/ in this project.
Before copying, show me the SKILL.md and list any scripts it includes, and wait for me to confirm.

    Or copy the folder yourself

    Unzip the download into .cursor/skills/ for this project, or ~/.cursor/skills/ for all your projects.

    Run it by typing / and the skill name in chat.

    Cursor skills docs
  • GitHub Copilot

    Run this in your project

    npx skills add https://github.com/aws/agent-toolkit-for-aws --skill creating-secrets-using-best-practices -a github-copilot

    Add -g to install it for every project instead.

    Or ask GitHub Copilot to do it

    Install the "creating-secrets-using-best-practices" skill from https://github.com/aws/agent-toolkit-for-aws for GitHub Copilot.
Copy the skill folder (the one containing SKILL.md, with any scripts or reference files next to it) into .github/skills/ in this project.
Before copying, show me the SKILL.md and list any scripts it includes, and wait for me to confirm.

    Or copy the folder yourself

    Unzip the download into .github/skills/ for this project, or ~/.copilot/skills/ for all your projects.

    Works in Copilot CLI, the cloud agent and agent mode in VS Code and JetBrains.

    GitHub Copilot skills docs
  • Antigravity

    Run this in your project

    npx skills add https://github.com/aws/agent-toolkit-for-aws --skill creating-secrets-using-best-practices -a antigravity

    Add -g to install it for every project instead.

    Or ask Antigravity to do it

    Install the "creating-secrets-using-best-practices" skill from https://github.com/aws/agent-toolkit-for-aws for Antigravity.
Copy the skill folder (the one containing SKILL.md, with any scripts or reference files next to it) into .agents/skills/ in this project.
Before copying, show me the SKILL.md and list any scripts it includes, and wait for me to confirm.

    Or copy the folder yourself

    Unzip the download into .agents/skills/ for this project, or ~/.gemini/config/skills/ for all your projects.

    Antigravity skills docs
  • Gemini CLI

    Run this in your project

    npx skills add https://github.com/aws/agent-toolkit-for-aws --skill creating-secrets-using-best-practices -a gemini-cli

    Add -g to install it for every project instead.

    Or ask Gemini CLI to do it

    Install the "creating-secrets-using-best-practices" skill from https://github.com/aws/agent-toolkit-for-aws for Gemini CLI.
Copy the skill folder (the one containing SKILL.md, with any scripts or reference files next to it) into .gemini/skills/ in this project.
Before copying, show me the SKILL.md and list any scripts it includes, and wait for me to confirm.

    Or copy the folder yourself

    Unzip the download into .gemini/skills/ for this project, or ~/.gemini/skills/ for all your projects.

    Run /skills to check it was found.

    Gemini CLI skills docs
Installs
5.2K via skills.sh
GitHub
2.6K stars ↗
Last updated
11 Sept 2026
Licence
Apache-2.0

Security checks

Run by independent scanners and published on skills.sh. Their results, not a Viberation review.

  • Gen Agent Trust Hub Pass

    This skill provides a robust framework for managing AWS secrets according to infrastructure best practices. It correctly emphasizes least-privilege access, encryption with dedicated KMS keys, and automated auditing through CloudTrail.

    17 May 2026

  • Socket Pass

    No alerts

    17 May 2026

  • Snyk Warning

    Risk: MEDIUM · 1 issue

    17 May 2026
What's inside (2 files)
  • references/create-secrets-using-best-practices.md9.9K chars
  • SKILL.md1.8K chars

SKILL.md. Shown as plain text.

---
name: creating-secrets-using-best-practices
description: Creates and manages secrets in AWS Secrets Manager following security best practices. Always use this skill when creating secrets — it sets up dedicated KMS encryption keys, automatic rotation, least-privilege IAM policies, CloudTrail auditing, and lifecycle management that are essential for production-grade secret handling.
version: 1
---

# Creating Secrets Using Best Practices

## Overview

Domain expertise for creating and managing secrets in AWS Secrets Manager with
production-grade security controls: KMS encryption, automatic rotation,
least-privilege IAM policies, CloudTrail auditing, and lifecycle management.

## Create a secret with best practices

To create a properly secured secret in AWS Secrets Manager, follow the procedure exactly.
See [secret creation procedure](references/create-secrets-using-best-practices.md).

The procedure supports four secret types: database credentials, API keys, OAuth tokens,
and custom secrets. Each type is structured appropriately and encrypted with a dedicated
KMS key.

## Troubleshooting

### KMS key access issues

Verify the IAM principal has `kms:CreateKey` and `kms:PutKeyPolicy` permissions, and that
the key policy grants `kms:GenerateDataKey`, `kms:Decrypt`, and `kms:DescribeKey` scoped
with `kms:ViaService` to `secretsmanager.<region>.amazonaws.com`. See the full procedure for details.

### Rotation setup failures

Check that the Lambda rotation function exists, has proper permissions, and can reach the
target system. Review CloudWatch logs for the rotation function.

### Secret access denied

Verify the IAM policy is attached to the correct principal, the KMS key policy allows
decryption (and `kms:GenerateDataKey` for write/rotation), and the principal is using HTTPS. See the full procedure for details.

Key info

Pricing
Open source
Category
Skills

Related reading

  • Fundamentals

    Row level security is the security boundary

    If your database rows are protected by a check in your application code, they are not protected. Anything holding a key can talk to the database directly, an…

    Expert

More in Skills