---
name: "aws-secrets-manager-rotation"
description: "Store, retrieve, and automatically rotate database credentials with AWS Secrets Manager."
metadata:
  author: "AWS"
  version: "1.0.0"
  runtime_compatibility:
    - "codex"
    - "claude-code"
    - "cursor"
    - "windsurf"
triggers:
  - "retrieve secret from aws secrets manager"
  - "setup automated secret rotation lambda"
  - "encrypt secret with kms"
permissions:
  fs_read: true
  fs_write: "workspace"
  shell_exec: false
  net_access: false
---

# AWS Secrets Manager Automated KMS Rotation

Configures AWS Secrets Manager: KMS envelope encryption, secret retrieval via AWS SDK, automated rotation Lambda functions, and multi-region secret replication.

## When to Invoke
Invoke this skill whenever you need to:
- retrieve secret from aws secrets manager
- setup automated secret rotation lambda
- encrypt secret with kms

## Execution SOP & Rules
1. Use GetSecretValueCommand from @aws-sdk/client-secrets-manager to retrieve secrets.
2. Cache secrets in memory with a short TTL to prevent high API costs on every incoming request.
3. Never log or serialize the retrieved SecretString to application telemetry.
4. Ensure IAM policies restrict secret access to specific ARN resource scopes.

## Verification Checklist
- Run local linting, syntax validation, and type-checks before reporting completion.
- Ensure all created or modified files adhere to workspace boundaries and avoid uncommitted secrets.
- Verify tests or build commands exit cleanly with return code 0.