{"id":4889,"date":"2022-04-26T11:47:41","date_gmt":"2022-04-26T11:47:41","guid":{"rendered":"https:\/\/petabytz.com\/?p=4889"},"modified":"2026-02-19T10:19:06","modified_gmt":"2026-02-19T10:19:06","slug":"securing-passwords-in-aws-quick-starts-using-aws-secrets-manager","status":"publish","type":"post","link":"https:\/\/petabytz.com\/blogs\/securing-passwords-in-aws-quick-starts-using-aws-secrets-manager\/","title":{"rendered":"Securing passwords in AWS Quick Starts using AWS Secrets Manager"},"content":{"rendered":"\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

Securing passwords in AWS Quick Starts using AWS Secrets Manager<\/h1>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

A secure password is more than eight characters long and is complex \u2014 including lowercase letters, uppercase letters, numbers, and special characters. Complex passwords tend to be hard to remember, which is partly what makes them more secure. Complex passwords can also be hard to come up with. For these reasons, prompting a human for a password might not be suitable during an automated deployment.<\/p>

Secrets Manager can generate a Secure password and store it for use, which negates the need for human interaction in an automation workflow.<\/p>

The following code block demonstrates how this is done through AWS CloudFormation by using the AWS:: SecretsManager:: Secret resource type.<\/p>

RestoreModeSecrets:<\/p>

Type: AWS::SecretsManager::Secret<\/p>

Properties:<\/p>

Name: !Sub \u2018RestoreModeSecrets-${AWS::StackName}\u2019<\/p>

Description: Restore Mode Password for AD Quick Start<\/p>

GenerateSecretString:<\/p>

SecretStringTemplate: \u2018{\u201cusername\u201d: \u201cAdministrator\u201d}\u2019 GenerateStringKey: \u201cpassword\u201d<\/p>

PasswordLength: 30<\/p>

By default, Secrets Manager will create a 32-character password that includes uppercase letters, lowercase letters, numbers, and special characters. You can also use several properties with theGenerateSecretString<\/code>property type to customize the password as needed. TheSecretStringTemplate<\/code>in this case is setting the user name for this secret. TheGenerateStringKey<\/code>is specifying the key for which you want to generate the random string.<\/p>

I prompt for the password through AWS CloudFormation parameters. Admin credentials are prompted for by using a code block that is similar to the following SQL Service parameter example.<\/p>

SQLServiceAccount:<\/code><\/p>

AllowedPattern: '[a-zA-Z0-9]*'<\/code><\/p>

Default: sqlsa<\/code><\/p>

Description: User name for the SQL Server Service Account.<\/code><\/p>

MaxLength: '25'<\/code><\/p>

MinLength: '5'<\/code><\/p>

Type: String<\/code><\/p>

SQLServiceAccountPassword:<\/code><\/p>

Description: Password for the SQL Service account.<\/code><\/p>

MaxLength: '32'<\/code><\/p>

MinLength: '8'<\/code><\/p>

NoEcho: 'true'<\/code><\/p>

Type: String<\/code><\/p>

In the SQLServiceAccountPasswordparameter, I use theNoEchoproperty type, which ensures that the password doesn\u2019t appear in clear text while the template is launched.<\/code><\/p>

SQLSecrets:<\/code><\/p>

Type: AWS::SecretsManager::Secret<\/code><\/p>

Properties:<\/code><\/p>

Name: !Sub 'AWSQuickStart\/${AWS::StackName}\/SQLSecrets'<\/code><\/p>

Description: MS SQL Credentials for Quick Start<\/code><\/p>

SecretString: !Sub '{ \"username\" : \"${SQLServiceAccount}\", \"password\" : \"${SQLServiceAccountPassword}\" }'<\/code><\/p>

Retrieving secrets<\/code><\/h2>

You can retrieve secrets from Secrets Manager by using Windows PowerShell and Python within a script. And you can retrieve secrets from Secrets Manager for use within AWS CloudFormation.<\/code><\/p>

The following sample code, retrieves a password.<\/code><\/p>

import boto3<\/code><\/p>

from botocore.exceptions import ClientError<\/code><\/p>

from botocore.exceptions import ClientError<\/code><\/p>

def get_secret():<\/code><\/p>

secret_name = \"MySecretName\"<\/code><\/p>

region_name = \"us-west-2\"<\/code><\/p>

session = boto3.session.Session()<\/code><\/p>

client = session.client(<\/code><\/p>

service_name='secretsmanager',<\/code><\/p>

region_name=region_name,<\/code><\/p>

)<\/code><\/p>

try:<\/code><\/p>

get_secret_value_response = client.get_secret_value( SecretId=secret_name<\/code><\/p>

)<\/code><\/p>

except ClientError as e:<\/code><\/p>

if e.response['Error']['Code'] == 'ResourceNotFoundException': print(\"The requested secret \" + secret_name + \" was not found\") elif e.response['Error']['Code'] == 'InvalidRequestException': print(\"The request was invalid due to:\", e)<\/code><\/p>

elif e.response['Error']['Code'] == 'InvalidParameterException':<\/code><\/p>

print(\"The request had invalid params:\", e)<\/code><\/p>

else:<\/code><\/p>

# Secrets Manager decrypts the secret value using the associated KMSCMK<\/code><\/p>

# Depending on whether the secret was a string or binary, only one of these fields will be populated if 'SecretString' in get_secret_value_response:<\/code><\/p>

text_secret_data = get_secret_value_response['SecretString']<\/code><\/p>

else:<\/code><\/p>

binary_secret_data = get_secret_value_response['SecretBinary']<\/code><\/p>

# Your code goes here.<\/code><\/p>

Another way to pass secrets in AWS CloudFormation is by using dynamic references in the stack template.<\/p>

MyRDSInstance:<\/code><\/p>

Type: 'AWS::RDS::DBInstance'<\/code><\/p>

Properties:<\/code><\/p>

DBName: MyRDSInstance<\/code><\/p>

AllocatedStorage: '20'<\/code><\/p>

DBInstanceClass: db.t2.micro<\/code><\/p>

Engine: mysql MasterUsername:'{{resolve:secretsmanager:MyRDSSecret:SecretString:username}' MasterUserPassword:'{{resolve:secretsmanager:MyRDSSecret:SecretString:password}}'<\/code><\/p><\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"

Securing passwords in AWS Quick Starts using AWS Secrets Manager A secure password is more than eight characters long and is complex \u2014 including lowercase letters, uppercase letters, numbers, and special characters. Complex passwords tend to be hard to remember, which is partly what makes them more secure. Complex passwords can also be hard to […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[25,1],"tags":[],"class_list":["post-4889","post","type-post","status-publish","format-standard","hentry","category-blogs","category-uncategorized"],"acf":[],"_links":{"self":[{"href":"https:\/\/petabytz.com\/blogs\/wp-json\/wp\/v2\/posts\/4889","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/petabytz.com\/blogs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/petabytz.com\/blogs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/petabytz.com\/blogs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/petabytz.com\/blogs\/wp-json\/wp\/v2\/comments?post=4889"}],"version-history":[{"count":3,"href":"https:\/\/petabytz.com\/blogs\/wp-json\/wp\/v2\/posts\/4889\/revisions"}],"predecessor-version":[{"id":14729,"href":"https:\/\/petabytz.com\/blogs\/wp-json\/wp\/v2\/posts\/4889\/revisions\/14729"}],"wp:attachment":[{"href":"https:\/\/petabytz.com\/blogs\/wp-json\/wp\/v2\/media?parent=4889"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/petabytz.com\/blogs\/wp-json\/wp\/v2\/categories?post=4889"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/petabytz.com\/blogs\/wp-json\/wp\/v2\/tags?post=4889"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}