Demo Password management with Amazon RDS and AWS Secrets Manager

Documentation Index

Fetch the complete documentation index at: https://notes.kodekloud.com/llms.txt

Use this file to discover all available pages before exploring further.

• Create an RDS (MariaDB) instance and let RDS auto-generate a strong master password.
• Retrieve the generated password from the RDS creation banner (the password is displayed only once).
• Store the username/password pair in AWS Secrets Manager and link the secret to the RDS instance.
• Use example client code (Python and Java) that reads the secret before creating DB connections.

1. Open the AWS Management Console and navigate to Amazon RDS.
2. Choose “DB instances” → “Create DB instance”.
3. For this demo select MariaDB and choose the Free tier (if eligible).
4. Provide a DB instance identifier (for example, my-application) and a master username (for example, admin).
5. Click “Auto-generate a password” to have RDS create a strong master password. Leave other defaults as appropriate for your environment.
6. Click “Create database”.

1. In the AWS Console search bar open AWS Secrets Manager.
2. Click “Store a new secret”.
3. Choose the secret type: “Credentials for RDS database”.
4. Enter the DB username (admin) and paste the master password you copied from the RDS banner.
5. Keep the KMS encryption key as the default (aws/secretsmanager) unless you require a custom KMS key.
6. Secrets Manager will list RDS instances available in the account/region — select the RDS instance you created (for example, my-application).
7. Click “Next”.
8. Provide a secret name (for example, application-01-secret) and an optional description.
9. Configure cross-region replication only if you need it; otherwise continue with “Next”.
10. Click “Store” to persist the secret into Secrets Manager.

• Install boto3: pip install boto3
• Ensure the application’s IAM role or IAM user has permission to call GetSecretValue: https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_GetSecretValue.html

import json
import boto3
from botocore.exceptions import ClientError

def get_secret(secret_name: str, region_name: str) -> dict:
    """
    Retrieve a secret from AWS Secrets Manager and return it as a dict.
    If the secret's SecretString contains JSON, this returns the parsed JSON.
    Otherwise returns {"secret": <SecretString>} or {"secretBinary": <bytes>}.

    Example secret JSON for RDS:
      {"username": "admin", "password": "generated-password", "host": "...", "port": 3306}
    """
    client = boto3.client("secretsmanager", region_name=region_name)

    try:
        response = client.get_secret_value(SecretId=secret_name)
    except ClientError as e:
        # Propagate or handle specific errors as required by your app
        raise e

    # SecretString contains a string; SecretBinary contains bytes if used.
    if "SecretString" in response and response["SecretString"]:
        secret_string = response["SecretString"]
        try:
            return json.loads(secret_string)
        except json.JSONDecodeError:
            return {"secret": secret_string}
    else:
        # SecretBinary is base64-encoded bytes
        return {"secretBinary": response.get("SecretBinary")}

• Ensure your build includes the AWS SDK v2 Secrets Manager module and that the app’s IAM identity has GetSecretValue permission.
• The method below returns the secret string; if it contains JSON, parse it into an object using your JSON library of choice.

// import software.amazon.awssdk.regions.Region;
// import software.amazon.awssdk.services.secretsmanager.SecretsManagerClient;
// import software.amazon.awssdk.services.secretsmanager.model.GetSecretValueRequest;
// import software.amazon.awssdk.services.secretsmanager.model.GetSecretValueResponse;
// import software.amazon.awssdk.services.secretsmanager.model.SecretsManagerException;

public static String getSecret(String secretName, String region) {
    Region awsRegion = Region.of(region);
    try (SecretsManagerClient client = SecretsManagerClient.builder()
            .region(awsRegion)
            .build()) {

        GetSecretValueRequest getSecretValueRequest = GetSecretValueRequest.builder()
                .secretId(secretName)
                .build();

        GetSecretValueResponse getSecretValueResponse = client.getSecretValue(getSecretValueRequest);

        if (getSecretValueResponse.secretString() != null) {
            return getSecretValueResponse.secretString();
        } else {
            // If secret is in binary form, handle it accordingly
            return getSecretValueResponse.secretBinary().asUtf8String();
        }
    } catch (SecretsManagerException e) {
        throw e;
    }
}

• Amazon RDS Documentation
• AWS Secrets Manager Documentation
• Secrets Manager API - GetSecretValue
• Secrets rotation with AWS Secrets Manager
• AWS KMS overview

• You provisioned a MariaDB instance in RDS and used the auto-generated master password.
• The auto-generated password is visible only once during creation; copy it immediately or store it in Secrets Manager.
• You stored the credential in AWS Secrets Manager and learned how to retrieve it from Python and Java applications, enabling secure, auditable access to DB credentials.
• Consider enabling automatic rotation and apply least-privilege IAM policies for production deployments.