--- title: "Using AWS CLI Secrets Manager to Manage Confidential Info" description: "Learn how to use the AWS CLI Secrets Manager to store, retrieve, and update your critical secret values used in AWS products!" canonical: "https://adamtheautomator.com/aws-cli-secrets-manager/" --- # Using AWS CLI Secrets Manager to Manage Confidential Info > Learn how to use the AWS CLI Secrets Manager to store, retrieve, and update your critical secret values used in AWS products! Source: https://adamtheautomator.com/aws-cli-secrets-manager/ --- ATA Learning Tap to hide [ ATA Learning ](/) * [Home](/) * [Tutorials](/tutorials/) * [Instructors](/author/) * [Advertising](/advertising/) * [Recommended Resources](/resources/) * [About Adam](/about-adam/) Search for: * [](https://twitter.com/adbertram) * [](https://github.com/Adam-the-Automator) * [](https://www.linkedin.com/company/adam-the-automator-llc) * [](/feed/) ![Using AWS CLI Secrets Manager to Manage Confidential Info](https://adamtheautomator.com/wp-content/uploads/2022/07/Tame-Your-Secrets-with-the-AWS-CLI-Secrets-Manager.jpg) # Using AWS CLI Secrets Manager to Manage Confidential Info [![](https://secure.gravatar.com/avatar/2beb65fca997135120ed98dc6a2e57dcdf1a7d7d2f5ff687b5d91dc7ccd7a6b5?s=192&d=mm&r=g)Sagar](https://adamtheautomator.com/author/shanky-mendiratta/)26 July 20225 min. read Categories: [IT Ops](/category/it-ops/) Tags:[AWS](/tag/aws/)[AWS CLI](/tag/aws-cli/) Table of Contents * [Prerequisites](#prerequisites) * [Configuring AWS CLI with AWS Credentials](#configuring-aws-cli-with-aws-credentials) * [Creating Secrets via the AWS CLI](#creating-secrets-via-the-aws-cli) * [Verifying the AWS Secrets via the AWS Management Console](#verifying-the-aws-secrets-via-the-aws-management-console) * [Authenticating AWS RDS DB Instance with the AWS CLI Secrets Manager](#authenticating-aws-rds-db-instance-with-the-aws-cli-secrets-manager) * [Conclusion](#conclusion) Are you saving your passwords in the text files, configuration files, or deployment files while deploying applications in the [Amazon AWS cloud](https://aws.amazon.com/free/?all-free-tier.sort-by=item.additionalFields.SortRank&all-free-tier.sort-order=asc&awsf.Free%20Tier%20Types=*all&awsf.Free%20Tier%20Categories=categories%23compute&trk=ps_a134p000006gEbfAAE&trkCampaign=acq_paid_search_brand&sc_channel=PS&sc_campaign=acquisition_IN&sc_publisher=Google&sc_category=Cloud%20Computing&sc_country=IN&sc_geo=APAC&sc_outcome=acq&sc_detail=aws%20cloud&sc_content=Cloud%20Hosting_e&sc_matchtype=e&sc_segment=476942607298&sc_medium=ACQ-P%7CPS-GO%7CBrand%7CDesktop%7CSU%7CCloud%20Computing%7CSolution%7CIN%7CEN%7CText&s_kwcid=AL!4422!3!476942607298!e!!g!!aws%20cloud&ef_id=CjwKCAiA0KmPBhBqEiwAJqKK4xY4H03eJJTbIjeSj9r0ARjwp3Ze9Va30rCIO6mpuLfiDnJxiihIUxoCIpgQAvD_BwE:G:s&s_kwcid=AL!4422!3!476942607298!e!!g!!aws%20cloud)? If yes, you’re putting your secrets at risk. Luckily, the [AWS CLI Secrets Manager](https://docs.aws.amazon.com/secretsmanager/latest/userguide/getting-started.html) keeps off attackers from getting exposed to your passwords. The [AWS CLI Secrets Manager](https://docs.aws.amazon.com/secretsmanager/latest/userguide/getting-started.html) solves all your security concerns, encrypts all your stored passwords, and decrypts only while retrieving them. In this tutorial, you’ll learn how to protect sensitive information from prying eyes. Ready? Read on and keep your secrets, well, a secret! ## P**rerequisites** This tutorial will be a step-by-step demonstration. If you’d like to follow along, be sure you have the following in place: * A Windows machine – This tutorial uses Windows 10, but later versions will also work. * An AWS IAM user with an [access key ID and a secret key](https://docs.aws.amazon.com/general/latest/gr/aws-sec-cred-types.html) [setup on your local machine](https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-profiles.html). The user must have access to create and manage Secrets – This tutorial uses an IAM user called _iamuser_. > _Ensure the [IAM](https://adamtheautomator.com/iam-aws/) user has_ [_programmatic access_](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_users_create.html) _and that you assign the user to the existing policy of AmazonIAMFullAccess._ Related:[Learning Identity and Access Management (IAM) AWS Through Examples](https://adamtheautomator.com/iam-aws/) * [A](https://docs.aws.amazon.com/cli/latest/userguide/cli-chap-configure.html)[WS CLI](https://docs.aws.amazon.com/cli/latest/userguide/cli-chap-configure.html) installed on your Windows machine. * An AWS RDS Microsoft SQL server database instance. Related:[How to Set up Amazon RDS PostgreSQL Database](https://adamtheautomator.com/rds-postgres/) * [AWS Schema Conversion Tool](https://s3.amazonaws.com/publicsctdownload/Windows/aws-schema-conversion-tool-1.0.latest.zip) installed on your Windows machine. ## Configuring AWS CLI with AWS Credentials AWS CLI is a command-line tool that allows you to work with AWS APIs to manage and provision the AWS services. But before you run any commands using AWS CLI, you must first configure AWS CLI with AWS credentials. Doing so allows you to connect to the AWS account and execute commands. To configure your AWS credentials on AWS CLI: 1\. Open command prompt as administrator, and run the following commands to configure AWS credentials ([aws configure](https://docs.aws.amazon.com/cli/latest/reference/configure/)). ```bash cd C:\Users # Change the working directory to C:\Users aws configure # Configure AWS credentials ``` Enter the AWS IAM user details, such as AWS Access Key ID, Secret Access Key, and region. You can skip the output format as default, text, or json. ![Configuring the AWS CLI](https://adamtheautomator.com/wp-content/uploads/2022/07/image-299.png) Configuring the AWS CLI 2\. Next, open File Explorer, navigate to the _C:\\Users\\%USERNAME%\\.aws_ directory, and verify if the credentials and config files are present. ![Checking the credentials and config files exist](https://adamtheautomator.com/wp-content/uploads/2022/07/image-300.png) Checking the credentials and config files exist 3\. Open the credentials and config files. You’ll notice the credentials you specified in step one are successfully stored in both. ![Viewing the credentials file’s content](https://adamtheautomator.com/wp-content/uploads/2022/07/image-301.png) Viewing the credentials file’s content ![Viewing the config file’s content](https://adamtheautomator.com/wp-content/uploads/2022/07/image-302.png) Viewing the config file’s content 4\. Finally, run the following commands to test if your AWS credentials are working. The command uses your AWS credentials to authenticate to the AWS account and retrieves the lists of all instances. ```bash # Change directory, one level up (C:\Users\%USERNAME%). cd .. # Retreive the lists of all instances. aws ec2 describe-instances ``` Notice that when you execute the command, you’ll connect to AWS resources using AWS APIs. ![Testing if the AWS credentials work](https://adamtheautomator.com/wp-content/uploads/2022/07/image-303.png) Testing if the AWS credentials work ## Creating Secrets via the AWS CLI You’ve successfully verified your AWS CLI configuration and AWS credentials work correctly, and now you’re ready your create your secrets. You’ll use these secrets to connect to a database in the latter part of this tutorial. Related:[PowerShell Encrypt Password Command via Secret Management Module](https://adamtheautomator.com/powershell-encrypt-password/) Create a file called _creds.json_ on your Desktop, and copy/paste the below configuration that contains database details, which you’ll later store as secrets. ```powershell { "username": "admin", "password": "password", "engine": "sqlserver" "host": "database-3.cgph34pcibdl.us-east-1.rds.amazonaws.com" "port": "1433" "dbInstanceIdentifier": "database-3" } ``` Next, run the below command to perform the following: * Change the working directory (`cd`) to your `Desktop` directory. * Create an AWS secret (`create-secret`) named `MySecret_DB` against the `creds.json` file. ```bash # Change working directory to Desktop cd Desktop # Create an AWS secret aws secretsmanager create-secret --name mySecret_DB --secret-string file://creds.json ``` The below output contains the secret’s **ARN**, **Name**, and **VersionId**. ![Creating an AWS secret in the AWS account](https://adamtheautomator.com/wp-content/uploads/2022/07/image-304.png) Creating an AWS secret in the AWS account > _You can update secrets as many times you wish by running the following command, where –secret-id_ specifies the secret’s ARN or name: _aws secrets manager update-secret –secret-id ARN\_OR\_NAME \\_ –secret-string “NewValue” ## Verifying the AWS Secrets via the AWS Management Console You’ve just created your secrets with AWS CLI, and that’s a huge step. But how do you know your secrets exist in your AWS cloud? Verify your AWS secrets by manually checking in the AWS Management Console. 1\. Open your favorite web browser and log in to the [AWS Management Console](https://aws.amazon.com/console/). 2\. Search for secretes on the console’s home page, and choose Secrets Manager from the result. Doing so redirects your browser to the page where you can see and manage your AWS Secrets Manager (step three). ![Accessing the AWS Secrets Manager service](https://adamtheautomator.com/wp-content/uploads/2022/07/image-305.png) Accessing the AWS Secrets Manager service 3\. Lastly, click on your secret from the list below to access your secrets’ information. ![Viewing the secrets in AWS Secrets Manager](https://adamtheautomator.com/wp-content/uploads/2022/07/image-306.png) Viewing the secrets in AWS Secrets Manager You’ll see the below page describing all the secret’s details, such as the Name, ARN, value ( Key/Value), and so on. ![Checking the details of the AWS secret](https://adamtheautomator.com/wp-content/uploads/2022/07/image-307.png) Checking the details of the AWS secret ## Authenticating AWS RDS DB Instance with the AWS CLI Secrets Manager Even though you’ve successfully verified your secrets, they’re just sitting in the AWS Secrets Manager service. Why not learn to retrieve them and perform authentication with the AWS RDS service? To authenticate with the AWS RDS DB instance using AWS Secrets Manager: 1\. Open the AWS Schema Conversion Tool (AWS VPN Client) from your Desktop or Start menu. ![Opening the AWS Schema Conversion Tool](https://adamtheautomator.com/wp-content/uploads/2022/07/image-308.png) Opening the AWS Schema Conversion Tool 2\. Next, click on File —> New Project to create a project. ![Creating a new Project in the AWS Schema Conversion Tool ](https://adamtheautomator.com/wp-content/uploads/2022/07/image-309.png) Creating a new Project in the AWS Schema Conversion Tool 3\. Enter a Project name (ATA\_Project) and the location where you wish to store the project, and click OK to create the project. After creating the project, you’ll see the project name (ATA\_Project) at the top of the window (step four). ![Providing project name and location](https://adamtheautomator.com/wp-content/uploads/2022/07/image-310.png) Providing project name and location 4\. Now, click Settings —> Global settings to open the Global settings window where you can add your AWS profile (step five). ![Adding a global setting](https://adamtheautomator.com/wp-content/uploads/2022/07/image-311.png) Adding a global setting 5\. On the Global settings window, click on Add a new AWS service profile to initiate adding a new AWS service profile. ![Initiating adding an AWS profile in the AWS Schema Conversion Tool ](https://adamtheautomator.com/wp-content/uploads/2022/07/image-312.png) Initiating adding an AWS profile in the AWS Schema Conversion Tool 6\. Next, enter details for the new AWS service profile: * **Profile name** – Set a unique profile name, but this tutorial’s choice is **NewProfile 1**. * **AWS access key** and **secret key** – Input the AWS access and secret keys in step one of the “Configuring AWS CLI with AWS Credentials” section. * **Region** – Set the region where you’d like to authenticate and connect to the AWS service. * Click **OK** to create the new AWS service profile. ![Creating a new AWS service profile ](https://adamtheautomator.com/wp-content/uploads/2022/07/image-313.png) Creating a new AWS service profile 7\. After creating an AWS service profile, click on the Add source from the toolbar to see the list of databases you can connect to (step eight). ![Initiating adding a database source](https://adamtheautomator.com/wp-content/uploads/2022/07/image-314.png) Initiating adding a database source 8\. Select the Microsoft SQL Server option, and click Next to configure your database source connection. ![Selecting Microsoft SQL Server as the database source ](https://adamtheautomator.com/wp-content/uploads/2022/07/image-315.png) Selecting Microsoft SQL Server as the database source 9\. Provide the following details for connecting to the Microsoft SQL Server: * **Connection name** – Input a connection name you like, but this tutorial uses **DB\_AWS\_secrets\_connection**.’ * **AWS Secret –** Select your AWS secret (**mySecret\_DB**), and click Populate. You’ll notice the AWS secrets you created in the AWS secrets manager are automatically populated in the required fields. ![Test Connection](https://adamtheautomator.com/wp-content/uploads/2022/07/image-316.png) Test Connection 10\. Now, click on Test connection to verify if the secrets are correct and can connect to the database created. Doing so tests whether the AWS Schema Conversation Tool can authenticate the AWS account and services. ![Testing database connection](https://adamtheautomator.com/wp-content/uploads/2022/07/image-317.png) Testing database connection 11\. Finally, click on **Connect** (bottom-right) to connect to the database. ![Connecting to the AWS RDS database using AWS Secrets Manager ](https://adamtheautomator.com/wp-content/uploads/2022/07/image-318.png) Connecting to the AWS RDS database using AWS Secrets Manager Once connected, you’ll see all database details, such as engine version, connection details, etc., as shown below. ![Overviewing database details](https://adamtheautomator.com/wp-content/uploads/2022/07/image-319.png) Overviewing database details ## Conclusion Managing your AWS secrets comes in various ways, such as directly using the AWS console or Terraform. But in this tutorial, you’ve learned how to store AWS secrets using the AWS CLI with a single command. Ultimately, you connected to your database using AWS secrets with the AWS Conversion Schema Tool. You’re now equipped with the knowledge of keeping your secrets safe from prying eyes. What do you plan to store next in AWS secrets using the AWS CLI? Share this article [Share on X](https://twitter.com/intent/tweet?url=https%3A%2F%2Fadamtheautomator.com%2Faws-cli-secrets-manager%2F&text=Using%20AWS%20CLI%20Secrets%20Manager%20to%20Manage%20Confidential%20Info)[Share on Facebook](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fadamtheautomator.com%2Faws-cli-secrets-manager%2F)[Share on LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fadamtheautomator.com%2Faws-cli-secrets-manager%2F) ## Related Posts ![](https://adamtheautomator.com/wp-content/uploads/2023/02/install-aws-cli-mac.jpg) ### [Streamline Your AWS Management with the AWS CLI Mac Client](/aws-cli-mac/) Take control of your AWS environment and streamline management through the use of the AWS CLI Mac client in this ATA Learning tutorial! ![](https://adamtheautomator.com/wp-content/uploads/2022/01/How-to-Create-a-Kubernetes-Cluster-With-the-AWS-EKS-CLI.jpg) ### [How to Create a Kubernetes Cluster With the AWS EKS CLI](/aws-eks-cli/) Learn how to create Kubernetes clusters to deploy containerized applications by setting up AWS EKS CLI and running commands in this step-by-step tutorial! ![](https://adamtheautomator.com/wp-content/uploads/2022/05/HMaster-Your-Data-with-AWS-Quicksight.jpg) ### [Make Data-Driven Decisions with AWS QuickSight Analytics](/aws-quicksight/) Struggling to make sense of your data? Discover how AWS QuickSight transforms data into actionable insights for smarter decision-making. ## Categories * [IT Ops](/category/it-ops/) * [Cloud](/category/cloud/) * [DevOps](/category/devops/) * [Home Ops](/category/home-ops/) * [Information Security](/category/infosec/) * [Software Development](/category/software-development/) ## Site * [Home](/) * [Tutorials](/tutorials/) * [Instructors](/author/) * [Advertising](/advertising/) * [Recommended Resources](/resources/) * [About Adam](/about-adam/) Copyright 2026© ATA Learning | [Privacy Policy](/privacy/)