AWS Secrets Manager in Use for RDS Instances

01 Sign in to AWS Management Console.

02 Navigate to AWS Secrets Manager dashboard at https://console.aws.amazon.com/secretsmanager/.

03 In the navigation panel, select Secrets.

04 Choose the secret that you want to examine, then click on its name to access the resource configuration details.

05 On the selected secret configuration page, in the Secret value section, click Retrieve secret value button to access the panel with the secret key/value.

06 Select the Secret key/value tab and check for any entry with the Secret Key set to host and Secret Value set to an RDS database endpoint such as <rds-instance-name>.<aws-region>.rds.amazonaws.com. If there is no secret key-value pair defined to hold an RDS database hostname (endpoint), the selected Amazon Secrets Manager secret does not manage AWS RDS database credentials.

07 Repeat steps no. 4 – 6 for each Secrets Manager secret available in the current AWS region. If there are no Secrets Manager secrets created to store and manage RDS database credentials, the Secrets Manager service in not in use for Amazon Relational Database Service (RDS) within the selected region.

08 Change the AWS region from the navigation bar to repeat the audit process for other regions.

01 Run list-secrets command (OSX/Linux/UNIX) to list the names of all Secrets Manager secrets available in the selected AWS region (US East - N. Virginia):

aws secretsmanager list-secrets
	--region us-east-1
	--query 'SecretList[*].Name'

02 The command output should return the names of the secrets available in the selected region:

[
    "cc-project5-credentials",
    "cc-api-access-credentials"
]

03 Run get-secret-value command (OSX/Linux/UNIX) using the name of the secret that you want to examine as identifier and jq, to expose the host secret key value defined for the selected Amazon Secrets Manager secret. The host secret key value contains the hostname of the database when a specified secret holds database credentials as protected information:

aws secretsmanager get-secret-value
	--region us-east-1
	--secret-id cc-project5-credentials | jq .SecretString | jq fromjson | jq .host

04 The command output should return the requested secret key value if the selected Secrets Manager secret contains database access credentials or null if the specified secret does not manage database credentials:

"127.0.0.1"

05 Repeat steps no. 3 and 4 for each Secrets Manager secret available in the selected AWS region. If there are no Secrets Manager secrets created to store and manage RDS database credentials, the Secrets Manager service in not in use for AWS Relational Database Service (RDS) within the selected region.

06 Change the AWS region by updating the --region command parameter value and repeat steps no. 1 – 5 to perform the entire process for other regions.

01 Sign in to AWS Management Console.

02 Navigate to AWS Secrets Manager dashboard at https://console.aws.amazon.com/secretsmanager/.

03 In the navigation panel, select Secrets.

04 Click Store a new secret button from the dashboard top menu to initiate the secret setup process.

05 On Select secret type page, perform the following:

1. Select Credentials for RDS database to configure the secret to store access credentials for an AWS RDS database instance.
2. In the Username and Password fields, type the user name and password that grant access to the RDS database associated with the secret.
3. From Select the encryption key dropdown list, choose the KMS key to use to encrypt the secret information.
4. From Select which RDS database this secret will access, list select the Amazon RDS database instance associated with the new Secrets Manager secret.
5. Click Next to continue the process.

06 On Secret name and description page, give the secret a unique name in the Secret name box and a short description in the Description box (optional). Create any necessary tag sets for your secret using the Tags form. Once the requested information is provided, click Next to continue.

07 On Store a new secret page, within Configure automatic rotation section, perform the following:

1. Select Enable automatic rotation to enable automatic rotation feature for the new secret.
2. Select a predefined (e.g. 30, 60, 90 days) or a custom value for the rotation interval from the Select rotation interval dropdown list.
3. Select Create a new Lambda function to perform rotation option to create your own custom Lambda function for rotation and give your new Lambda function a name in the New AWS Lambda function name box, or select Use an existing Lambda function to perform rotation to implement an AWS Lambda function that you have previously created for rotating this type of secret and choose this existing Lambda function from Choose an AWS Lambda function dropdown list.
4. Choose Next to continue.

08 On the Review page, verify the secret configuration details, then click Store to create the Amazon Secrets Manager secret that will manage your AWS RDS database credentials.

09 Once the following confirmation message is displayed: "Your secret <secret-name> has been successfully stored.", click See sample code button to access the sample code that you can use to update your applications in order to retrieve the new secret.

10 Repeat steps no. 4 – 10 to create new Secrets Manager secrets to store and manage database credentials for your AWS RDS instances available in the current region.

11 Change the AWS region from the navigation bar and repeat the process for other regions.

01 Define the protected secret information required for the "SecretString" parameter. The secret information is a JSON structure of key/value pairs that AWS Secrets Manager service knows how to parse. Save the secret data to a JSON file named rds-db-credentials.json (replace the highlighted details, i.e. the RDS database instance access credentials, with your own database credentials):

{
  "username": "<db-user-name>",
  "password": "<db-password>",
  "engine": "<db-engine-type>",
  "host": "<rds-instance-name>.<aws-region>.rds.amazonaws.com",
  "port": <db-port>,
  "dbname": "<db-name>",
  "dbInstanceIdentifier": "<rds-db-instance-name>"
} 

02 Run create-secret command (OSX/Linux/UNIX) using the JSON file with the secret information created at the previous step (i.e. rds-db-credentials.json) as command parameter to create the new Amazon Secrets Manager secret that will store and manage your AWS RDS database credentials:

aws secretsmanager create-secret
	--region us-east-1
	--name cc-rds-database-credentials
	--description "Provides access to MySQL production database"
	--kms-key-id arn:aws:kms:us-east-1:123456789012:key/1234abcd-1234-abcd-1234-abcd1234abcd
	--secret-string file://rds-db-credentials.json

03 The command output should return the new AWS Secrets Manager secret metadata:

{
    "VersionId": "abcdabcd-1234-1234-1234-abcdabcdabcd",
    "Name": "cc-rds-database-credentials",
    "ARN": "arn:aws:secretsmanager:us-east-1:123456789012:secret:cc-rds-database-credentials-ABCABC"
} 

04 Repeat steps no. 1 – 3 to create new Secrets Manager secrets to store and manage database credentials for your AWS RDS instances available in the selected region.

05 Change the AWS region by updating the --region command parameter value and repeat the entire remediation/resolution process for other regions.