Secrets Manager · AWS Secrets Manager

Outcome

• Credentials, Rotation & Access Control
  • Created a JSON secret and a plain string secret via CLI
  • Retrieved a secret by name, by ARN, and by version stage
  • Parsed a JSON secret in Python and used individual fields
  • Observed AWSCURRENT / AWSPREVIOUS labels move after put-secret-value
  • Used update-secret-version-stage to manually roll back to a prior version
  • Wrote a four-step rotation Lambda (createSecret, setSecret, testSecret, finishSecret)
  • Deployed the Lambda with correct IAM role and resource policy
  • Enabled automatic rotation and verified Lambda logs show all four steps
  • Created a path-scoped IAM policy using wildcard (not exact ARN)
  • Attached a resource-based policy to a secret
  • Wrote a condition-key policy restricting access to AWSCURRENT only
  • Explained the ECS valueFrom format for JSON key extraction
  • Explained the VPC endpoint requirement for private subnet access
  • Cleaned up in the correct order: rotation → policies → secrets → Lambda → IAM