Demo Password management with Amazon RDS and AWS Secrets Manager

import json
import boto3
from botocore.exceptions import ClientError

def get_secret(secret_name: str, region_name: str) -> dict:
    """
    Retrieve a secret from AWS Secrets Manager and return it as a dict.
    If the secret's SecretString contains JSON, this returns the parsed JSON.
    Otherwise returns {"secret": <SecretString>} or {"secretBinary": <bytes>}.

    Example secret JSON for RDS:
      {"username": "admin", "password": "generated-password", "host": "...", "port": 3306}
    """
    client = boto3.client("secretsmanager", region_name=region_name)

    try:
        response = client.get_secret_value(SecretId=secret_name)
    except ClientError as e:
        # Propagate or handle specific errors as required by your app
        raise e

    # SecretString contains a string; SecretBinary contains bytes if used.
    if "SecretString" in response and response["SecretString"]:
        secret_string = response["SecretString"]
        try:
            return json.loads(secret_string)
        except json.JSONDecodeError:
            return {"secret": secret_string}
    else:
        # SecretBinary is base64-encoded bytes
        return {"secretBinary": response.get("SecretBinary")}

// import software.amazon.awssdk.regions.Region;
// import software.amazon.awssdk.services.secretsmanager.SecretsManagerClient;
// import software.amazon.awssdk.services.secretsmanager.model.GetSecretValueRequest;
// import software.amazon.awssdk.services.secretsmanager.model.GetSecretValueResponse;
// import software.amazon.awssdk.services.secretsmanager.model.SecretsManagerException;

public static String getSecret(String secretName, String region) {
    Region awsRegion = Region.of(region);
    try (SecretsManagerClient client = SecretsManagerClient.builder()
            .region(awsRegion)
            .build()) {

        GetSecretValueRequest getSecretValueRequest = GetSecretValueRequest.builder()
                .secretId(secretName)
                .build();

        GetSecretValueResponse getSecretValueResponse = client.getSecretValue(getSecretValueRequest);

        if (getSecretValueResponse.secretString() != null) {
            return getSecretValueResponse.secretString();
        } else {
            // If secret is in binary form, handle it accordingly
            return getSecretValueResponse.secretBinary().asUtf8String();
        }
    } catch (SecretsManagerException e) {
        throw e;
    }
}