{"id":4687,"date":"2025-11-04T15:09:29","date_gmt":"2025-11-04T15:09:29","guid":{"rendered":"https:\/\/geekmungus.co.uk\/?p=4687"},"modified":"2025-11-04T15:09:56","modified_gmt":"2025-11-04T15:09:56","slug":"simple-aws-secrets-manager-example","status":"publish","type":"post","link":"https:\/\/geekmungus.co.uk\/?p=4687","title":{"rendered":"Simple AWS Secrets Manager Example"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">A simple example using AWS CloudFormation that creates an IAM User and then stores the user&#8217;s AccessKey and SecretKey within AWS Secrets Manager to get a hold of the value (which otherwise only exists once at creation).<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>AWSTemplateFormatVersion: \"2010-09-09\"\nDescription: A simple secrets example\n\nParameters:\n  # None\n\nResources:\n  BudgetReadOnlyUser:\n    Type: AWS::IAM::User\n    Properties:\n      UserName: \"BudgetReader\"\n      Path: \/budget\/\n      ManagedPolicyArns:\n        - arn:aws:iam::aws:policy\/AWSBudgetsReadOnlyAccess\n      Tags:\n        - Key: environment\n          Value: !Ref Environment\n        - Key: wsi_owner\n          Value: !Ref WSIOwner\n        - Key: project_code\n          Value: !Ref ProjectCode\n        - Key: budget_code\n          Value: !Ref BudgetCode\n        - Key: function\n          Value: \"Budgets\"\n  \n  AccessKey:\n    Type: AWS::IAM::AccessKey\n    Properties:\n      UserName: !Ref BudgetReadOnlyUser\n\n  AccessKeyStored:\n    Type: AWS::SecretsManager::Secret\n    Properties:\n      Name: !Sub \/budget\/credentials\/${BudgetReadOnlyUser}\n      SecretString: !Sub '{\"ACCESS_KEY\":\"${AccessKey}\",\"SECRET_KEY\":\"${AccessKey.SecretAccessKey}\"}'\n\nOutputs:\n   # None<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Assuming your user account has access to AWS Secrets Manager, you&#8217;ll then find it available here:<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"475\" src=\"https:\/\/geekmungus.co.uk\/wp-content\/uploads\/2025\/11\/image-3-1024x475.png\" alt=\"\" class=\"wp-image-4688\" srcset=\"https:\/\/geekmungus.co.uk\/wp-content\/uploads\/2025\/11\/image-3-1024x475.png 1024w, https:\/\/geekmungus.co.uk\/wp-content\/uploads\/2025\/11\/image-3-300x139.png 300w, https:\/\/geekmungus.co.uk\/wp-content\/uploads\/2025\/11\/image-3-768x356.png 768w, https:\/\/geekmungus.co.uk\/wp-content\/uploads\/2025\/11\/image-3-1536x713.png 1536w, https:\/\/geekmungus.co.uk\/wp-content\/uploads\/2025\/11\/image-3.png 1795w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Click &#8220;Retrieve Secret Value&#8221; to show the hidden stored secret values.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Bear in mind that each secret carries a $0.40 per month cost.<\/p>\n\n\n\n<h1 class=\"wp-block-heading\" id=\"SimpleAWSSecretsManagerExample-AdditionalInformation\">Additional Information<\/h1>\n\n\n\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/stackoverflow.com\/questions\/40865710\/declaring-an-iam-access-key-resource-by-cloudformation\">https:\/\/stackoverflow.com\/questions\/40865710\/declaring-an-iam-access-key-resource-by-cloudformation<\/a><\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>A simple example using AWS CloudFormation that creates an IAM User and then stores the user&#8217;s AccessKey and SecretKey within AWS Secrets Manager to get a hold of the value (which otherwise only exists once at creation). Assuming your user account has access to AWS Secrets Manager, you&#8217;ll then find it available here: Click &#8220;Retrieve &#8230; <a title=\"Simple AWS Secrets Manager Example\" class=\"read-more\" href=\"https:\/\/geekmungus.co.uk\/?p=4687\" aria-label=\"Read more about Simple AWS Secrets Manager Example\">Read more<\/a><\/p>\n","protected":false},"author":4,"featured_media":3999,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[28,59,42],"tags":[],"class_list":["post-4687","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-aws","category-cloudformation","category-devops"],"_links":{"self":[{"href":"https:\/\/geekmungus.co.uk\/index.php?rest_route=\/wp\/v2\/posts\/4687","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/geekmungus.co.uk\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/geekmungus.co.uk\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/geekmungus.co.uk\/index.php?rest_route=\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/geekmungus.co.uk\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=4687"}],"version-history":[{"count":1,"href":"https:\/\/geekmungus.co.uk\/index.php?rest_route=\/wp\/v2\/posts\/4687\/revisions"}],"predecessor-version":[{"id":4689,"href":"https:\/\/geekmungus.co.uk\/index.php?rest_route=\/wp\/v2\/posts\/4687\/revisions\/4689"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/geekmungus.co.uk\/index.php?rest_route=\/wp\/v2\/media\/3999"}],"wp:attachment":[{"href":"https:\/\/geekmungus.co.uk\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=4687"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/geekmungus.co.uk\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=4687"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/geekmungus.co.uk\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=4687"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}