Keep app secrets out of code — Secrets Manager

Your goal

Let a server get a database password without publishing it in source code.

Why this matters

A password copied into a shared code repository can spread quickly. You will choose a secret store, limit who can read it, and plan a safe password change.

Words you will use

A secret is sensitive data such as a database password. Rotation replaces a secret. A role gives an app permission to retrieve it.

How to proceed

Read each situation and choose an answer. The lesson explains the result. Try again if needed, then continue through all three decisions and finish the tour.

1. Choose a safe home

Your server needs a database password. The source repository is shared with many people. Choose where to store the password.

Where does the secret belong?

In Secrets Manager, read by the authorized server.

A secret store keeps the value separate from source code. Retrieve it on the server when needed. Anything sent to browser code can be inspected by the visitor.

The database password stays out of the app’s public files.

Server role → GetSecretValue → database connection

2. Limit secret access

This app needs one database secret, not every secret in the account. Choose a permission plan.

What should the role be allowed to read?

Only the intended secret and any required key access.

Scope retrieval to the required secret. If encryption uses a key requiring additional permission, check that access too. Avoid logging the returned value.

The app receives the one secret it needs without broad read access.

App policy → intended secret only

3. Change both sides safely

The password must change. Updating the stored value alone would leave the database expecting the old password. Choose a complete rotation plan.

What must stay in agreement?

The database password, stored secret, and app’s refreshed value.

Rotation must update the target system and the stored value safely. The app must refresh cached credentials and reconnect. Test the rotation process before relying on it.

The app can reconnect after a planned secret change.

Rotate target + secret → refresh app credentials → test connection

Practice, then check your understanding

In the interactive tour, make each decision before seeing the outcome. Wrong answers receive coaching, and replay gives you a fresh attempt without duplicating earned XP.

Read the official AWS documentation for service behavior and production details.