c6.6 Store application credentials in Secrets Manager

Never hardcode the app's secrets

AI applications accumulate credentials: third-party model API keys, database passwords, OAuth client secrets, webhook signing keys. The moment any of these is pasted into source, an environment variable in a build script, or a container image layer, it becomes something you cannot rotate cleanly, audit precisely, or revoke without a redeploy — and it may leak through your own model's output or logs. AWS Secrets Manager stores these encrypted with KMS, rotates them on a schedule, audits every read in CloudTrail, and hands the value to your workload at runtime over an IAM-authenticated API call.

Store the secret, encrypted with your key

Create the secret encrypted with a customer managed key so you control access to the key as well as the secret:

aws secretsmanager create-secret \
  --name "prod/ai-app/model-provider-api-key" \
  --description "Third-party model API key for the AI app" \
  --secret-string '{"apiKey":"REPLACE_ME"}' \
  --kms-key-id "arn:aws:kms:us-east-1:111122223333:key/<key-id>"

Retrieve at runtime, never at build time

The application fetches the secret when it runs, using its IAM role — the value is never baked into the image or config:

aws secretsmanager get-secret-value \
  --secret-id "prod/ai-app/model-provider-api-key" \
  --query SecretString --output text

Scope the app role's secretsmanager:GetSecretValue to this specific secret ARN, and add a resource policy on the secret so only that role can read it.

Turn on rotation

A secret that never changes is a standing risk. Enable automatic rotation so a leaked value has a limited lifetime:

aws secretsmanager rotate-secret \
  --secret-id "prod/ai-app/model-provider-api-key" \
  --rotation-rules '{"AutomaticallyAfterDays": 30}' \
  --rotation-lambda-arn "arn:aws:lambda:us-east-1:111122223333:function:RotateModelApiKey"

For AWS-native credentials (like RDS), Secrets Manager provides managed rotation; for third-party API keys you supply a small rotation Lambda that calls the provider's key-rotation API.

Naming note: use a clear path-style secret name (env/app/purpose), a customer managed KMS key, and scope both the IAM policy and the secret's resource policy to the one app role. Replace the key and Lambda ARNs.