- Newest
- Most votes
- Most comments
To securely manage credentials for connecting your website to AWS services, you should use AWS Secrets Manager rather than hardcoding keys directly in your application.
Here's how to create and store your AWS credentials securely:
Creating a Secret in AWS Secrets Manager:
- Open the AWS Secrets Manager console
- Choose "Store a new secret"
- For Secret type, select "Other type of secret"
- Enter your credentials as key/value pairs (for example, access key ID and secret access key)
- Choose an encryption key - you can use the AWS managed key (aws/secretsmanager) at no additional cost, or use your own customer managed key
- Complete the setup by naming your secret and configuring any additional options
Retrieving the Secret in Your Application:
Instead of storing keys directly in your code, your application should retrieve them from Secrets Manager at runtime. You'll need to:
- Ensure your application has the appropriate IAM permissions (specifically
secretsmanager:GetSecretValue) - Use the AWS SDK for your programming language to call
GetSecretValueorBatchGetSecretValue - The SDK will decrypt the secret using the associated KMS key and return the value to your application
This approach keeps your credentials encrypted and secure, allows for automatic rotation, and provides full audit trails through CloudTrail. It's much safer than storing keys directly in your code or configuration files.
Sources
Move hardcoded secrets to AWS Secrets Manager - AWS Secrets Manager
Create an AWS Secrets Manager secret - AWS Secrets Manager
Get a Secrets Manager secret value using the PHP AWS SDK - AWS Secrets Manager
answered 2 months ago
Quick clarification, since "secret key" could mean two things:
If you mean an IAM access key (the Access Key ID + Secret Access Key your site uses to authenticate to AWS): the secret is shown only once, when you create the key. AWS doesn't store it in a retrievable form, so it can't be looked up later. Check the .csv you downloaded at creation — if it's gone, create a new key and delete the old one:
- IAM console → Users → your user → Security credentials.
- Under Access keys, choose Create access key, then copy the secret (or download the
.csv) immediately. - Update your site, verify, then deactivate and delete the old key.
Doc : https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html
If you mean a value stored in AWS Secrets Manager (e.g. a DB password or API key): that one is retrievable anytime from the Secrets Manager console or via GetSecretValue.
Doc: https://docs.aws.amazon.com/secretsmanager/latest/userguide/retrieving-secrets.html
For a website, AWS recommends avoiding long-term access keys where possible — if it runs on AWS compute (EC2, Lambda, ECS), attach an IAM role so credentials are supplied and rotated automatically, and don't use root user keys. https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html
answered a month ago
Relevant content
asked 3 years ago
asked 2 years ago
- AWS OFFICIALUpdated a year ago
