What You Will Learn

• Why secrets should not be hardcoded.
• What AWS Secrets Manager provides.
• How applications access secrets securely.
• IAM and rotation basics.
• Production practices for Java applications.

Introduction

Secrets include:

• Database passwords.
• API keys.
• OAuth client secrets.
• Encryption keys.
• Third-party credentials.

Do not store secrets in source code, logs, Docker images, or plain config files.

Secrets Manager Flow

sequenceDiagram
    participant App as Spring Boot App
    participant IAM
    participant ASM as AWS Secrets Manager
    App->>IAM: Use role credentials
    App->>ASM: Request secret
    ASM-->>App: Secret value
    App->>App: Use secret for connection

IAM Principle

Grant only the secrets the application needs.

Example policy scope:

Allow read for prod/app/payment-db only

Avoid broad access like:

secretsmanager:GetSecretValue on *

Spring Boot Usage Pattern

Common approach:

• Store secret in AWS Secrets Manager.
• Attach IAM role to ECS, EKS, Lambda, or EC2.
• Load secret during startup or through config integration.
• Cache secret value for performance.

Rotation

Secret rotation changes credentials periodically.

Plan for:

• Database user rotation.
• Application reconnect behavior.
• Rollback.
• Monitoring failed authentication.

Production Checklist

• Use IAM roles, not static AWS keys.
• Restrict secret access by environment.
• Enable audit logging with CloudTrail.
• Avoid printing secret values.
• Cache carefully and refresh on rotation.
• Separate dev, test, and prod secrets.

Summary

AWS Secrets Manager helps remove secrets from code and configuration. Pair it with least-privilege IAM, rotation, audit logging, and safe application startup.

Learning Path Navigation

• Series home: Spring Security Learning Path
• Previous: Database Encryption and JPA Attribute Converter
• Next: Hashing vs Encryption vs Tokenization