‫So now let's look into a service called Secrets manager.
‫And the name is extremely obvious for one of the services that will be easily storing secrets into us.
‫And so with this you can rotate then manage them and you retrieve them.
‫And with API calls for their lifecycle.
‫So the big difference of secrets manager you'll have with something like payment a store with an encrypted
‫value like a secure string is that with secrets manager you can set up some rotation and you can link
‫it to a lambda function that will allow you to rotate your credentials on top of it.
‫It has a very tight integration with RDX or postgres and so on and so the idea is that it will be a
‫little bit more easy to use and more secure with this.
‫But the idea is the same you're going to store secrets into a store and retrieve them at runtime.
‫So the pricing is that you have 40 cents per secrets per month and five cents for 10000 API calls and
‫you get a 30 day free trial available for the secret spending.
‫OK.
‫So it's all obviously managed by I am for access to the do the secret.
‫So this is kind of like a similar thing to private restore.
‫So let's go ahead and store and your secrets and so as you can see we get different type of secrets
‫and I'm pretty sure they will add secrets over time to make this even more integrated with other AWOL
‫services.
‫But we can do a credential for an audience database a credential for if cluster for a document DB database
‫for an other database or an other type of secrets.
‫And this is for example an API key.
‫So here this is really important.
‫Whenever you have a database it will prompt you would like a user name and a password and pretty much
‫using her and password for everything here.
‫OK but if it's an other type of secrets then you will have key value pairs that you can place and you
‫will have secrets placed in here so you can set for example API key and then you would have the secret
‫value of the API key.
‫Right.
‫And this would be the your key value pair.
‫But you could have multiple ones you can just store not just one API key.
‫You could store for example secrets key for the API and you have a second value.
‫Second secret value.
‫Right.
‫So you really free you have many as many key value pairs.
‫And that's also a little bit of a difference versus versus something like the payment a store.
‫So you can do this in secret or you can also do it in plaintext in your basement.
‫Jason So this is would be a way to copy and paste.
‫Jason if you prefer this to entering things manually in this UI then you select the encryption key.
‫So do you want a default encryption key or do you want to use a claim as could you have created and
‫so on to encrypt these secrets so I'll use my Kaminsky for example and then I'll click on next.
‫Then you need to give it your secret a name so I'll call it proud prod my secret API and then you can
‫have a description and you can have tags and then you click on next and then here we can configure automatic
‫or not automatic rotation.
‫So that means that if you have automated or mimic rotation automatically your secrets will be rotated.
‫And so that means that for example here I can say every 60 days I want you to rotate my secret.
‫You can have a custom value if you want it to the max being 1 year.
‫And so that means that after 60 days there will be a lended function that will be invoked.
‫And so you need to create that line the function and that lambda function needs to have the role to
‫rotate that secrets.
‫So that means for example generating a new user name or refreshing the API key credentials with a third
‫party.
‫And so you're free to do whatever you want with your lambda functions.
‫But the idea is that after 60 days it will be invoked automatically by secrets manager to rotate the
‫secret the secrets we have just stored and that makes it a really powerful secret management solution.
‫So right now disable the automatic rotation and click on Next.
‫And so we're good to go and we can have simple code in any of our languages that we commonly used to
‫retrieve that secrets for example with Python.
‫If we look at it there is a get secret function and you pass in the secret name the region name and
‫then you just initiate a client to do API calls and then to get the value you do clients that get secret
‫value you put in this you pass in the secret IP which is a secret name and then you get the response
‫and in the response then you can just look at the keys that you need for example in the key value pair
‫we had and here secret string is the value of the key you want to retrieve and that's it's very very
‫fairly simple and you have this for the language you are.
‫So if you're more of a good person here's go JavaScript Java and so on.
‫OK.
‫And that's as easy as it is to use the secrets manager.
‫And so this is just a normal key value pair of secrets.
‫And let me just show you how to do our guest database.
‫So I'll call this admin and then super secret password and then we would encrypt those as well.
‫And similarly you can also link this to an RDX database that the secret will access.
‫So the idea is that with these special integration with RDX or redshift or document dv you would have
‫to select a database to integrate this with.
‫So that makes it a little bit more powerful because now the secret's manager will hold the value of
‫the username and password.
‫But on top of it it will also set these values on the linked RDX database automatically.
‫And you can also enable rotation as well to make sure that the secret rotates every so often.
‫So this one it's just to show you this but you are not going to create an audience database just for
‫the sake of linking the secrets to it but you get the idea.
‫So that's it's in a nutshell for secrets manager.
‫When you're done you can just delete that secrets and you'll be good to go and you can have a waiting
‫period as well just to make sure that it doesn't get updated deleted hastily.
‫So that's it for this lecture.
‫I hope you liked it.
‫And then we'll see you in the next lecture.