creating-secrets-using-best-practices

An agent skill by aws, from aws/agent-toolkit-for-aws. Tags: aws, compliance, iam, secrets, security.

What it does

Creates and manages secrets in AWS Secrets Manager following security best practices. Always use this skill when creating secrets — it sets up dedicated KMS encryption keys, automatic rotation, least-privilege IAM policies, CloudTrail auditing, and lifecycle management that are essential for production-grade secret handling.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add aws/agent-toolkit-for-aws --skill creating-secrets-using-best-practices

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/aws/agent-toolkit-for-aws
cp -r agent-toolkit-for-aws/skills/specialized-skills/security-and-identity-skills/creating-secrets-using-best-practices ~/.claude/skills/creating-secrets-using-best-practices

Safety box score

Grade D, elevated risk: 51 of 100 risk points, rated 2026-10-14. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill is for creating and managing AWS Secrets Manager secrets, and it expands into KMS keys, IAM policies, CloudTrail, CloudWatch, and Lambda rotation. The main risks are broad AWS-side effects and direct handling of raw secret values, including optional file- or URL-based inputs that can move sensitive data around.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	1 (low)	It expects the agent to execute AWS-side operations and a CLI check (`aws sts get-caller-identity`), but there are no native scripts or code evaluators shipped with the skill.
Network access	2 (moderate)	The procedure sends requests to AWS services (Secrets Manager, KMS, CloudTrail, CloudWatch) and can also ingest configuration from a URL, so it has real external network reach.
Filesystem reach	1 (low)	It supports a "File path" input for secret configuration, which means the agent may read local files, but the skill does not write or delete local files.
Secrets & credentials	3 (high)	The skill requires a `secret_value`, accepts direct input/file/URL sources, and explicitly warns "You MUST NOT log or display the actual secret value," so it will handle sensitive credentials.
Privilege & persistence	2 (moderate)	It creates and edits AWS IAM/KMS policies, including `kms:CreateKey`, `kms:PutKeyPolicy`, and retaining the root account as key administrator, which changes cloud privilege boundaries.
Instruction hijack surface	0 (none)	The text is procedural, but it does not try to override higher-priority instructions, hide content, or fetch remote prompt text to follow.
Irreversible actions	3 (high)	The skill directs the agent to create secrets, KMS keys, IAM policies, rotation, CloudTrail, and CloudWatch alarms—multiple irreversible AWS changes inherent to its purpose.
Transparency	0 (none)	The shipped files are plain markdown only; there are no binaries, installers, minified blobs, or decoded-at-runtime code.

Before installing

Test it in a non-production AWS account with a dummy secret and a restricted role first.
Read `references/create-secrets-using-best-practices.md` for the exact inputs it will collect, especially `secret_value` and any file/URL sources.
Confirm whether you are comfortable granting the agent permission to create KMS keys, IAM policies, CloudTrail, and CloudWatch resources.
Make sure no real secret material will be supplied via chat, local files, or URLs unless you intend to expose it to the agent.

Rated 2026-10-14 by an automated review of 2 files from the skill's repository.

Source

Repository: aws/agent-toolkit-for-aws (all skills from this repository)
Path: skills/specialized-skills/security-and-identity-skills/creating-secrets-using-best-practices/SKILL.md
Branch: main
Updated: 2026-09-19

aws-security — Covers AWS security services and workflows — Security Hub V2 (OCSF) findings, connectors, aggregators, automation rules, and security posture summaries.
aws-cleanrooms — Troubleshoots and debugs AWS Clean Rooms collaboration issues related to IAM roles, S3 bucket policies, KMS keys, Lake Formation permissions.
securing-s3-buckets — Create and secure S3 buckets following AWS best practices for access control, encryption, monitoring, and remediation of misconfigurations.
setting-up-cloudtrail-multi-region — Enables a multi-region AWS CloudTrail trail with S3 log storage, CloudWatch Logs integration.
github-sensitive-data-cleanup — Scan and remove sensitive data (secrets, API keys, private domains/IPs, PII) from GitHub repository history.
aws-iam — Provides verified corrections for IAM behaviors that AI agents frequently get wrong — policy evaluation edge cases, trust policy gotchas, STS session limits.