‫Okay, so now let's
‫talk about Secrets Manager.
‫So this is a newer kind of service and it is meant
‫for storing secrets, as the name indicates.
‫So Secrets Manager is a great way to store secrets,
‫but on top of it, you can force the rotation
‫of these secrets, I mean, they have to change
‫every X number of days.
‫For example, you can say, "Okay, every 90 days,
‫I want to change my passwords."
‫And so, you can do this in Secrets Manager.
‫You can automate the generation
‫of these secrets using Lambda.
‫And it has an integration with Amazon RDS.
‫So using the Secrets Manager, we can create
‫the passwords for Amazon RDS automatically.
‫The secrets are going to be encrypted using KMS,
‫that we just saw from before, automatically.
‫And so from an exam perspective,
‫anytime you see a secret to be managing in RDS
‫and to be rotated, you have to think about Secrets Manager.
‫It is a paid service,
‫but I'll just show you how it works very briefly.
‫So let's find the Secrets Manager UI.
‫So I'll go into Secrets Manager and from there,
‫I will be able to create and manage secrets.
‫So as you can see, they can be rotated, they can be managed,
‫and retrieved throughout their lifecycle.
‫I'm going to store a new secret
‫and if you see, before the pricing,
‫it says it's 40 cents per secret per month
‫and then you're going to pay for API call,
‫but you get a 30-day free trial available.
‫So we can store a new secret
‫and the secret can be a credential for a database,
‫for example, for RDS or for Redshift
‫or for another database or for another type of secret.
‫So this is where you can enter
‫whatever you want as a secret.
‫But, for example, as with for RDS database,
‫you need to specify the user name and the password,
‫as well as how the secret will be encrypted
‫and which RDS database will be linked to that secret.
‫So we can't do this right now
‫because we don't have an RDS database,
‫but if we wanted to store just a random kind of secret,
‫we could say password and then here
‫you could say MYSECRETPASSWORD.
‫And this will be the value of our secret.
‫And then you just choose, again,
‫how you would encrypt that secret.
‫Then you would click on next
‫and then you would give the secret a name,
‫for example, myproductionapplicationpassword,
‫which is a terrible name and then you click on next
‫and then when you're ready, you can configure the secret.
‫So, do you want it to have automatic rotation or not?
‫And yes, I want it.
‫I want it to be rotating every 30 days, for example,
‫and then choose the Lambda function
‫that will be rotating the password for me.
‫So you would need to create it in advance.
‫When you're done, you can review everything
‫and see that yes, we have created a secret,
‫it will have some secret value,
‫automatic rotation is enabled using a Lambda function
‫and then you can see some sample code
‫to retrieve the secrets in our applications.
‫I won't go with creating a secret, but you get the idea
‫and this is all you need to know about the Secrets Manager.
‫So that's it.
‫I will cancel this and I will see you in the next lecture.