creating-secrets-using-best-practices
Creates and manages secrets in AWS Secrets Manager following security best practices.
Skill by awsOfficial
Chalk Labs
Need help deploying creating-secrets-using-best-practices?
Chalk Labs sets up agents like this inside real teams: connected to your tools, tested on your data, with a human in the loop where it matters.
Install
Works with Claude Code, Claude apps, Codex, Cursor, Gemini CLI, GitHub Copilot, VS Code, OpenCode, Goose, Windsurf. Read the repository before you give any tool access to your data.
npx agentmarket install skill/aws-creating-secrets-using-best-practices
Asks which of your tools to add it to (Claude Code, Codex, Cursor, VS Code, Windsurf, Gemini CLI, Claude Desktop) and shows the change first. See https://agentmart.dev/cli.
Get the weekly diff
The weekly diff: one email a week with new agent tools, notable updates and grade changes, plus security alerts for tools you follow. Double opt-in, one-click unsubscribe.
About
Use cases: cloud, security
Reviews
Write a reviewNo reviews yet. Installed it? Reviews come from verified installers only. How reviews work
Permissions
What this skill can do and what it asks for, from its SKILL.md. Checked Oct 25, 2026.
- Tools
- No tools found
- Secrets
- None asked for
- Install scripts
- None found
Network hosts it talks to 1
codeload.github.com· found in install command
Files it touches
~/.claude/skills/creating-secrets-using-best-practices
What's inside
- Skill name
creating-secrets-using-best-practices- Description
- Creates and manages secrets in AWS Secrets Manager following security best practices. Always use this skill when creating secrets — it sets up dedicated KMS encryption keys, automatic rotation, least-privilege IAM policies, CloudTrail auditing, and lifecycle management that are essential for production-grade secret handling.
- License
- Apache-2.0
- Instructions
- 36 lines in SKILL.md · view on GitHub
Files (2)
- SKILL.md
- create-secrets-using-best-practices.md · references/
SKILL.md (first lines)
# Creating Secrets Using Best Practices ## Overview Domain expertise for creating and managing secrets in AWS Secrets Manager with production-grade security controls: KMS encryption, automatic rotation, least-privilege IAM policies, CloudTrail auditing, and lifecycle management. ## Create a secret with best practices To create a properly secured secret in AWS Secrets Manager, follow the procedure exactly. See [secret creation procedure](references/create-secrets-using-best-practices.md). The procedure supports four secret types: database credentials, API keys, OAuth tokens, and custom secrets. Each type is structured appropriately and encrypted with a dedicated KMS key. ## Troubleshooting ### KMS key access issues Verify the IAM principal has `kms:CreateKey` and `kms:PutKeyPolicy` permissions, and that the key policy grants `kms:GenerateDataKey`, `kms:Decrypt`, and `kms:DescribeKey` scoped with `kms:ViaService` to `secretsmanager.<region>.amazonaws.com`. See the full procedure for details. ### Rotation setup failures Check that the Lambda rotation function exists, has proper permissions, and can reach the target system. Review CloudWatch logs for the rotation function. ### Secret access denied Verify the IAM policy is attached to the correct principal, the KMS key policy allows decryption (and `kms:GenerateDataKey` for write/rotation), and the principal is using HTTPS. See the full procedure for details.
From aws/agent-toolkit-for-aws, Apache-2.0.
More from aws/agent-toolkit-for-aws
- 0.843score
agents-build
aws-agentcoreOfficial
Use to extend an existing agent project with memory, app integration, VPC, multi-agent, migration, model, browser, code interpreter, payments, or resource…
SkillAFreshness: A★ 3KClaude Code +9 - 0.782score
agents-pay
aws-agentcoreOfficial
Use when THIS agent needs to pay for x402-protected content at runtime: hitting a paywall mid-task, settling it via AgentCore Payments, and applying…
SkillBFreshness: B★ 3KClaude Code +9 - 0.739score
agents-optimize
aws-agentcoreOfficial
Use when measuring or improving agent quality and performance — set up evaluators, online monitoring, CI/CD quality gates, observability, or cost optimization.
SkillCFreshness: C★ 3KClaude Code +9 - 0.739score
agents-deploy
aws-agentcoreOfficial
Use when deploying your agent to AWS, or when a deploy has failed.
SkillCFreshness: C★ 3KClaude Code +9 - 0.734score
agents-get-started
aws-agentcoreOfficial
Use when a developer wants to create a new agent project or get started with AgentCore.
SkillCFreshness: C★ 3KClaude Code +9 - 0.724score
aws-transform
AWSOfficial
Performs code upgrades, migrations, and transformations using the AWS Transform (ATX) CLI.
SkillCFreshness: C★ 3KClaude Code +9 - 0.724score
agents-debug
aws-agentcoreOfficial
Use when your agent or environment is broken — wrong answers, errors, timeouts, tool failures, or CLI issues.
SkillCFreshness: C★ 3KClaude Code +9 - 0.724score
agents-harden
aws-agentcoreOfficial
Use when preparing your agent for production — IAM scoping, inbound auth (JWT, SigV4), secrets management, cold start optimization, session lifecycle, rate…
SkillCFreshness: C★ 3KClaude Code +9 - 0.700score
agents-connect
aws-agentcoreOfficial
Use when connecting your agent to external APIs, tools, or services via Gateway, or restricting tool access with Cedar policies.
SkillCFreshness: C★ 3KClaude Code +9 - 0.682score
knowledge-base-for-startups
awsOfficial
AWS Startups reference content — Activate FAQ, credits guide, programs, partner offers, sample architectures, and hundreds of learn articles spanning…
SkillAFreshness: A★ 3KClaude Code +9 - 0.682score
aws-sms-voice
awsOfficial
Onboards RCS Business Messaging and Notify OTP via the pinpoint-sms-voice-v2 AWS CLI.
SkillAFreshness: A★ 3KClaude Code +9 - 0.682score
agent-advisor
awsOfficial
Entry point for AI-agent work on AWS: pick a runtime, plan a migration for existing workloads, and build an executable POC — one phased flow.
SkillAFreshness: A★ 3KClaude Code +9
Signals
- Stars
- 3,049
- Forks
- 394
- Open issues
- 40
- Last commit (this folder)
- May 13, 2026 (5 months ago)
From GitHub (fetched Oct 24, 2026).
Details
- License
- Apache-2.0
- Repository
- github.com/aws/agent-toolkit-for-aws
- First seen
- Oct 24, 2026
- Last checked
- Oct 24, 2026
- Source
- GitHubgithub-graphql
Same skill elsewhere
Copies of this SKILL.md published by others; search shows only one of them.
More from aws
- 0.781score
AWS MCP Server
awsOfficial
A managed MCP server enabling AI agents to access AWS using docs, API calls, and SOP workflows.
ConnectorBFreshness: BLocal↓ 416.2K/wkClaude Code +5 - 0.781score
AWS MCP Server
awsOfficial
AWS MCP Server lets AI securely access AWS using docs, API calls, and SOP workflows.
ConnectorBFreshness: BLocal↓ 416.2K/wkClaude Code +5 - 0.682score
agent-advisor
awsOfficial
Entry point for AI-agent work on AWS: pick a runtime, plan a migration for existing workloads, and build an executable POC — one phased flow.
SkillAFreshness: A★ 3KClaude Code +9 - 0.682score
prompt-library-for-startups
awsOfficial
AWS-curated copy-paste prompts for AI coding agents (MVP scaffolding, RAG chatbot with Claude on Bedrock, security baseline evaluation, cost anomaly…
SkillAFreshness: A★ 3KClaude Code +9 - 0.682score
knowledge-base-for-startups
awsOfficial
AWS Startups reference content — Activate FAQ, credits guide, programs, partner offers, sample architectures, and hundreds of learn articles spanning…
SkillAFreshness: A★ 3KClaude Code +9 - 0.682score
aws-sms-voice
awsOfficial
Onboards RCS Business Messaging and Notify OTP via the pinpoint-sms-voice-v2 AWS CLI.
SkillAFreshness: A★ 3KClaude Code +9
Done for you
Rather not set it up yourself?
Chalk Labs scopes, builds and runs agents for your team: the task audit, the eval harness, the integrations and the weekly ops report. Fixed scope, priced before we start.
See how we build AI agents →Read the case studies
Chalk Labs is a two-founder AI and growth studio. We build AI agents, CRMs and MVPs for Web3 and AI companies, and have shipped 50+ product and token launches.
- launches shipped
- 50+
- launches shipped
- media placements
- 500+
- media placements
- founders on every account
- 2
- founders on every account
Press we've placed: Forbes · CoinDesk · Decrypt · Cointelegraph · The Block
Rahil Jain, Co-founder, Chalk Labs. Ex-Goldman Sachs engineer. You talk to the person who builds it.
Get creating-secrets-using-best-practices running in your business
Tell us what you want to automate. A founder replies within one working day with a plan, not a pitch deck.
Cite this page
creating-secrets-using-best-practices skill. Agent Mart. https://agentmart.dev/skills/aws-creating-secrets-using-best-practices (last updated 2026-10-24)