Setting the skill. One moment.
Security And Identity Skills
Skill 110 of 130
Creates and manages secrets in AWS Secrets Manager following security best practices.
1 minute · 172 words · 6 sections
Install
npx skills add aws/agent-toolkit-for-aws --skill creating-secrets-using-best-practicesnpx skills add aws/agent-toolkit-for-aws/plugin marketplace add aws/agent-toolkit-for-awsThe first command installs just this skill, by the name in its SKILL.md; the second installs the whole repository.
Domain expertise for creating and managing secrets in AWS Secrets Manager with production-grade security controls: KMS encryption, automatic rotation, least-privilege IAM policies, CloudTrail auditing, and lifecycle management.
To create a properly secured secret in AWS Secrets Manager, follow the procedure exactly. See secret creation procedure (opens in a new tab).
The procedure supports four secret types: database credentials, API keys, OAuth tokens, and custom secrets. Each type is structured appropriately and encrypted with a dedicated KMS key.
Verify the IAM principal has kms:CreateKey and kms:PutKeyPolicy permissions, and that
the key policy grants kms:GenerateDataKey, kms:Decrypt, and kms:DescribeKey scoped
with kms:ViaService to secretsmanager.<region>.amazonaws.com. See the full procedure for details.
Check that the Lambda rotation function exists, has proper permissions, and can reach the target system. Review CloudWatch logs for the rotation function.
Verify the IAM policy is attached to the correct principal, the KMS key policy allows
decryption (and kms:GenerateDataKey for write/rotation), and the principal is using HTTPS. See the full procedure for details.
Creates and manages secrets in AWS Secrets Manager following security best practices. Always use this skill when creating secrets — it sets up dedicated KMS encryption keys, automatic rotation, least-privilege IAM policies, CloudTrail auditing, and lifecycle management that are essential for production-grade secret handling.
The verbatim description from this skill’s front matter — the string an agent matches on to decide whether to load it.
main, last pushed 24 September 2026.SKILL.md, not by matching a directory convention. 19 distinct layouts observed: plugins/aws-agents-for-devsecops/skills/*/SKILL.md, plugins/aws-agents/skills/*/SKILL.md, plugins/aws-core/skills/*/SKILL.md, skills/core-skills/*/SKILL.md, skills/specialized-skills/analytics-skills/*/SKILL.md, skills/specialized-skills/database-skills/*/SKILL.md, skills/specialized-skills/ec2-skills/*/SKILL.md, skills/specialized-skills/end-user-computing-skills/*/SKILL.md, skills/specialized-skills/messaging-and-streaming-skills/*/SKILL.md, skills/specialized-skills/migration-and-modernization-skills/*/SKILL.md, skills/specialized-skills/networking-and-content-delivery-skills/*/SKILL.md, skills/specialized-skills/operations-skills/*/SKILL.md, skills/specialized-skills/quantum-computing-skills/*/SKILL.md, skills/specialized-skills/resilience-skills/*/SKILL.md, skills/specialized-skills/security-and-identity-skills/*/SKILL.md, skills/specialized-skills/serverless-skills/*/SKILL.md, skills/specialized-skills/storage-skills/*/SKILL.md, skills/specialized-skills/system-table-skills/*/SKILL.md, skills/specialized-skills/web-and-mobile-development/*/SKILL.md.h1 and no skipped levels:.claude-plugin/marketplace.json by Amazon Web Services, declaring 4 plugins. It is read for editorial metadata only — never as the skill index, which is always the repository tree./aws/agent-toolkit-for-aws.md, and each skill at its own .md URL.1 file · 10 KB
Everything this skill ships beside its prose. All of it is set here, as a subchapter of skill 110.
Documentation the agent loads on demand, rather than up front.