Secrets Manager and Parameter Store

Sign in and set up:

cd C:\aws-lab
aws login --profile saat-admin
$env:AWS_PROFILE = 'saat-admin'
$v = Get-Content C:\aws-lab\saat-vpc.json | ConvertFrom-Json
$acct = aws sts get-caller-identity --query Account --output text

1Store settings in Parameter Store

Paste this whole block:

aws ssm put-parameter --name /saat/app/db_host --type String --value saat-db.internal --tags Key=course,Value=saatvedha-aws | Out-Null
aws ssm put-parameter --name /saat/app/features --type StringList --value 'orders,reports' --tags Key=course,Value=saatvedha-aws | Out-Null
aws ssm put-parameter --name /saat/app/db_password --type SecureString --value 'Lab-Only-Pass-91' --tags Key=course,Value=saatvedha-aws | Out-Null
aws ssm get-parameters-by-path --path /saat/app --recursive --with-decryption --query "Parameters[].[Name,Type,Value]" --output text

You should see this:

/saat/app/db_host       String          saat-db.internal
/saat/app/db_password   SecureString    Lab-Only-Pass-91
/saat/app/features      StringList      orders,reports

One call reads everything under /saat/app. A path per app and environment (/prod/orders/, /test/orders/) makes permissions simple.

2Create a secret and give it a new version

Paste this whole block:

$pw = aws secretsmanager get-random-password --password-length 24 --exclude-punctuation --query RandomPassword --output text
[ordered]@{ username = 'appuser'; password = $pw; host = 'saat-db.internal'; port = 1433 } | ConvertTo-Json -Compress | Set-Content secret.json
$secretArn = aws secretsmanager create-secret --name saat/app/db --description "lesson 31 app database login" --secret-string file://secret.json --tags Key=course,Value=saatvedha-aws --query ARN --output text
$secretArn
$pw2 = aws secretsmanager get-random-password --password-length 24 --exclude-punctuation --query RandomPassword --output text
[ordered]@{ username = 'appuser'; password = $pw2; host = 'saat-db.internal'; port = 1433 } | ConvertTo-Json -Compress | Set-Content secret.json
aws secretsmanager put-secret-value --secret-id saat/app/db --secret-string file://secret.json | Out-Null
Remove-Item secret.json
aws secretsmanager list-secret-version-ids --secret-id saat/app/db --query "Versions[].VersionStages" --output text

You should see something like this:

arn:aws:secretsmanager:ap-south-1:111122223333:secret:saat/app/db-AbCdEf
AWSCURRENT
AWSPREVIOUS

Notice the -AbCdEf at the end of the ARN; you’ll meet it again in the break lab. The old password is still available as AWSPREVIOUS, which is what lets rotation happen without breaking apps that haven’t re-read yet. Real rotation runs on a schedule; you’ll see managed rotation for RDS in Lesson 44.

3Give a server read access

Paste this whole block. It adds a scoped policy to the instance role, the Secrets Manager endpoint and app01:

@'
{
  "Version": "2012-10-17",
  "Statement": [
    { "Effect": "Allow", "Action": [ "ssm:GetParameter", "ssm:GetParameters", "ssm:GetParametersByPath" ], "Resource": "arn:aws:ssm:ap-south-1:ACCT:parameter/saat/app/*" },
    { "Effect": "Allow", "Action": "secretsmanager:GetSecretValue", "Resource": "arn:aws:secretsmanager:ap-south-1:ACCT:secret:SECRET_RESOURCE" }
  ]
}
'@ -replace 'ACCT', $acct -replace 'SECRET_RESOURCE', 'saat/app/*' | Set-Content read-app-config.json
aws iam put-role-policy --role-name saat-ec2-ssm-role --policy-name read-saat-app-config --policy-document file://read-app-config.json
.\Start-SsmEndpoints.ps1
$smEp = aws ec2 create-vpc-endpoint --vpc-id $v.VpcId --vpc-endpoint-type Interface --service-name com.amazonaws.ap-south-1.secretsmanager --subnet-ids $v.PrivateA --security-group-ids $v.EndpointSg --private-dns-enabled --tag-specifications 'ResourceType=vpc-endpoint,Tags=[{Key=Name,Value=saat-secretsmanager-ep},{Key=course,Value=saatvedha-aws},{Key=lesson,Value=31}]' --query VpcEndpoint.VpcEndpointId --output text
$base = aws ssm get-parameter --name /aws/service/ami-amazon-linux-latest/al2023-ami-kernel-default-x86_64 --query Parameter.Value --output text
$i = aws ec2 run-instances --image-id $base --instance-type t3.micro --subnet-id $v.PrivateA --security-group-ids $v.AppSg --iam-instance-profile Name=saat-ec2-ssm-profile --metadata-options HttpTokens=required --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=app01},{Key=course,Value=saatvedha-aws},{Key=lesson,Value=31}]' --query "Instances[0].InstanceId" --output text
do { Start-Sleep 20; $p = aws ssm describe-instance-information --filters "Key=InstanceIds,Values=$i" --query "InstanceInformationList[0].PingStatus" --output text } until ($p -eq 'Online')
do { Start-Sleep 10; $s = aws ec2 describe-vpc-endpoints --vpc-endpoint-ids $smEp --query "VpcEndpoints[0].State" --output text } until ($s -eq 'available')
"$p $s"

You should see this:

Online available

4Read both values from the server

Paste this whole block:

'{ "commands": [ "aws ssm get-parameter --name /saat/app/db_host --query Parameter.Value --output text --region ap-south-1", "aws secretsmanager get-secret-value --secret-id saat/app/db --query SecretString --output text --region ap-south-1" ] }' | Set-Content read-params.json
$cmd = aws ssm send-command --document-name AWS-RunShellScript --instance-ids $i --parameters file://read-params.json --query Command.CommandId --output text
Start-Sleep 15
aws ssm get-command-invocation --command-id $cmd --instance-id $i --query StandardOutputContent --output text

You should see something like this:

saat-db.internal
{"username":"appuser","password":"V8qt2LmZ0pRw4sXc7nBd1KfH","host":"saat-db.internal","port":1433}

The server never had a password in its image, user data or files; it asked with its role. Printing a secret to command output is only for this lab. Run Command keeps output in its history, so real apps read secrets in code and never log them.

✅ Checkpoint: Three parameters are under /saat/app, saat/app/db has AWSCURRENT and AWSPREVIOUS versions, and app01 read the host and the secret with its instance role. Keep everything for the break lab.