0Pricing
Serverless Backend with AWS Lambda & API Gateway · Lesson

Protecting Secrets with AWS Secrets Manager

Stop hardcoding credentials in Lambda. Learn to store, rotate, and retrieve API keys and database passwords securely using AWS Secrets Manager.

Protecting Secrets with AWS Secrets Manager is a free Serverless Backend with AWS Lambda & API Gateway lesson on CoddyKit — lesson 4 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Serverless Backend with AWS Lambda & API Gateway learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.

Why Not Hardcode Secrets?

Embedding API keys or DB passwords in your Lambda code or environment variables is risky: anyone with read access can see them, and rotating them means a redeploy.

AWS Secrets Manager centralizes secrets, encrypts them, and supports automatic rotation.

What Secrets Manager Stores

Common secrets include:

  • Database credentials
  • Third-party API keys
  • OAuth tokens
  • Encryption keys

Each secret is encrypted at rest with AWS KMS.

Creating a Secret

Secrets are stored as key/value JSON. You can create one from the CLI.

aws secretsmanager create-secret \
  --name prod/db/credentials \
  --secret-string '{"username":"admin","password":"S3cr3t!"}'

Granting Lambda Access

Your Lambda execution role needs permission to read the secret. Scope it to the exact ARN, not a wildcard.

{
  "Effect": "Allow",
  "Action": "secretsmanager:GetSecretValue",
  "Resource": "arn:aws:secretsmanager:us-east-1:123:secret:prod/db/credentials-*"
}

Retrieving a Secret in Code

Use the AWS SDK to fetch the secret value at runtime.

const { SecretsManager } = require("@aws-sdk/client-secrets-manager");
const sm = new SecretsManager();
const res = await sm.getSecretValue({ SecretId: "prod/db/credentials" });
const creds = JSON.parse(res.SecretString);

Caching Secrets

Calling Secrets Manager on every invocation adds latency and cost. Fetch once outside the handler so the value is reused across warm invocations.

let cached;
async function getCreds() {
  if (!cached) {
    const r = await sm.getSecretValue({ SecretId: "prod/db/credentials" });
    cached = JSON.parse(r.SecretString);
  }
  return cached;
}

Automatic Rotation

Secrets Manager can rotate credentials on a schedule using a rotation Lambda. For supported databases (RDS), AWS provides a ready-made rotation function so passwords change without code edits.

Secrets vs Parameter Store

SSM Parameter Store also stores config and SecureString values, and is cheaper. Use Parameter Store for plain config; use Secrets Manager when you need built-in rotation and cross-account sharing.

Encryption with KMS

Every secret is encrypted with a KMS key. Use the default AWS-managed key for simplicity, or a customer-managed key (CMK) for fine-grained access control and audit.

Auditing Access

Every GetSecretValue call is logged to CloudTrail. Review these logs to detect unexpected access and prove compliance.

Best Practices

Keep secrets safe:

  • Never log the secret value
  • Scope IAM to the exact secret ARN
  • Enable rotation for long-lived credentials
  • Cache across warm invocations, not in source control

Quick Check

Test your Secrets Manager knowledge.

Recap

You learned to secure credentials:

  • Store secrets in Secrets Manager, never in code
  • Grant least-privilege IAM to the exact ARN
  • Fetch with the SDK and cache across warm invocations
  • Enable automatic rotation and audit via CloudTrail

Frequently asked questions

Is the “Protecting Secrets with AWS Secrets Manager” lesson free?

Yes — the full text of “Protecting Secrets with AWS Secrets Manager” is free to read here on the web, and the Serverless Backend with AWS Lambda & API Gateway course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Serverless Backend with AWS Lambda & API Gateway course, upgrade to CoddyKit PRO.

What will I learn in “Protecting Secrets with AWS Secrets Manager”?

Stop hardcoding credentials in Lambda. Learn to store, rotate, and retrieve API keys and database passwords securely using AWS Secrets Manager. You practise Serverless Backend with AWS Lambda & API Gateway with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start Serverless Backend with AWS Lambda & API Gateway?

No prior experience is required. Serverless Backend with AWS Lambda & API Gateway on CoddyKit is structured for beginners through advanced learners; this is — lesson 4 of 4, so you can start here or from the beginning and move at your own pace.

How long does the “Protecting Secrets with AWS Secrets Manager” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this Serverless Backend with AWS Lambda & API Gateway lesson?

Yes. Every Serverless Backend with AWS Lambda & API Gateway lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

  1. IAM Roles and Permissions
  2. API Gateway Authorizers
  3. Securing Lambda with VPC
  4. Protecting Secrets with AWS Secrets Manager
← Back to Serverless Backend with AWS Lambda & API Gateway