aws-sdk-java-v2-secrets-manager

Name: aws-sdk-java-v2-secrets-manager
Author: giuseppe-trisciuoglio

1.6kinstalls36forks

How to install aws-sdk-java-v2-secrets-manager?

giuseppe-trisciuoglio/developer-kit/aws-sdk-java-v2-secrets-manager

$npx -y skills add giuseppe-trisciuoglio/developer-kit --skill aws-sdk-java-v2-secrets-manager

Installs into the current project.

Summary

Provides AWS Secrets Manager patterns for AWS SDK for Java 2.x, including secret retrieval, caching, rotation-aware access, and Spring Boot integration. Use when storing or reading secrets in Java services, replacing hardcoded credentials, or wiring secret-backed configuration in

Files · 1

View on GitHub

SKILL.md

1	# AWS SDK for Java 2.x - AWS Secrets Manager
2
3	## Overview
4
5	Use this skill to manage application secrets with AWS Secrets Manager from Java services.
6
7	It focuses on the operational flow that matters in production:
8	- how to retrieve and deserialize secrets safely
9	- when to add local caching
10	- how to integrate secret access into Spring Boot without leaking values into logs or configuration files
11
12	Keep large API notes and extended setup details in the bundled references.
13
14	## When to Use
15
16	Use this skill when:
17	- replacing hardcoded passwords, API keys, or tokens with managed secrets
18	- loading database credentials or third-party API credentials at runtime
19	- adding caching to reduce Secrets Manager latency and API cost
20	- handling secret version stages such as `AWSCURRENT` and `AWSPENDING`
21	- wiring secret access into Spring Boot beans or configuration services
22	- preparing rotation-aware applications or Lambda rotation workflows
23
24	Typical trigger phrases include `java secrets manager`, `spring boot secret`, `aws secret cache`, `load db credentials from secrets manager`, and `rotate secret`.
25
26	## Instructions
27
28	### 1. Model the secret before writing access code
29
30	Decide:
31	- the secret name and path convention
32	- whether the value is plain text or structured JSON
33	- which application boundary is allowed to read it
34	- whether the caller needs the latest value on every request or can tolerate a cache
35
36	Prefer JSON secrets for multi-field credentials such as database connection details.
37
38	### 2. Create one reusable client per application configuration
39
40	Use a single `SecretsManagerClient` with explicit region and the default credential provider chain unless the environment requires something more specific.
41
42	Keep client creation in configuration code, not in business services.
43
44	### 3. Retrieve and deserialize at the boundary layer
45
46	At the integration boundary:
47	- fetch with `GetSecretValueRequest`
48	- deserialize JSON into a typed object or validated map
49	- convert AWS exceptions into application-level errors
50	- never log `secretString()` or include it in thrown exception messages
51
52	### 4. Add caching only where it solves a real problem
53
54	Use caching when:
55	- the secret is read frequently
56	- latency matters for startup or request handling
57	- the cost of repeated lookups is material
58
59	Document cache TTL expectations clearly, especially if the secret rotates.
60
61	### 5. Design for rotation and staged versions
62
63	If the secret rotates:
64	- read through a thin service layer so cache invalidation and retry behavior stay centralized
65	- understand which callers must tolerate `AWSPENDING` during verification workflows
66	- test how the application behaves during stale cache windows or partial rotation failures
67
68	### 6. Validate end-to-end behavior
69
70	Before shipping:
71	- verify IAM permissions and KMS access
72	- test missing secret, wrong region, and decryption failure paths
73	- confirm secrets are not surfaced in logs, metrics, or debug endpoints
74	- prove database or API clients refresh correctly when credentials rotate
75
76	## Examples
77
78	### Example 1: Reusable client and typed secret lookup
79
80	```java
81	@Configuration
82	public class SecretsConfiguration {
83
84	@Bean
85	SecretsManagerClient secretsManagerClient() {
86	return SecretsManagerClient.builder()
87	.region(Region.of("eu-south-2"))
88	.credentialsProvider(DefaultCredentialsProvider.create())
89	.build();
90	}
91	}
92
93	@Service
94	public class SecretsService {
95
96	private final SecretsManagerClient client;
97	private final ObjectMapper objectMapper;
98
99	public SecretsService(SecretsManagerClient client, ObjectMapper objectMapper) {
100	this.client = client;
101	this.objectMapper = objectMapper;
102	}
103
104	public DatabaseSecret loadDatabaseSecret(String secretId) throws JsonProcessingException {
105	GetSecretValueResponse response = client.getSecretValue(
106	GetSecretValueRequest.builder().secretId(secretId).build()
107	);
108	return objectMapper.readValue(response.secretString(), DatabaseSecret.class);
109	}
110	}
111	```
112
113	### Example 2: Cache a hot-path secret lookup
114
115	```java
116	public class CachedSecretsService {
117
118	private final SecretCache cache;
119
120	public CachedSecretsService(SecretsManagerClient client) {
121	this.cache = new SecretCache(client);
122	}
123
124	public String apiToken(String secretId) {
125	return cache.getSecretString(secretId);
126	}
127	}
128	```
129
130	Use this pattern only when the application can tolerate the chosen cache refresh behavior.
131
132	## Best Practices
133
134	- Use hierarchical secret names that match domain and environment boundaries.
135	- Prefer typed JSON d

People who liked this also viewed

6 picks

Type

aws-sdk-java-v2-secrets-manager

1.6kinstalls36forks

View on GitHub

How to install aws-sdk-java-v2-secrets-manager?

giuseppe-trisciuoglio/developer-kit/aws-sdk-java-v2-secrets-manager

$npx -y skills add giuseppe-trisciuoglio/developer-kit --skill aws-sdk-java-v2-secrets-manager

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# AWS SDK for Java 2.x - AWS Secrets Manager
2
3	## Overview
4
5	Use this skill to manage application secrets with AWS Secrets Manager from Java services.
6
7	It focuses on the operational flow that matters in production:
8	- how to retrieve and deserialize secrets safely
9	- when to add local caching
10	- how to integrate secret access into Spring Boot without leaking values into logs or configuration files
11
12	Keep large API notes and extended setup details in the bundled references.
13
14	## When to Use
15
16	Use this skill when:
17	- replacing hardcoded passwords, API keys, or tokens with managed secrets
18	- loading database credentials or third-party API credentials at runtime
19	- adding caching to reduce Secrets Manager latency and API cost
20	- handling secret version stages such as `AWSCURRENT` and `AWSPENDING`
21	- wiring secret access into Spring Boot beans or configuration services
22	- preparing rotation-aware applications or Lambda rotation workflows
23
24	Typical trigger phrases include `java secrets manager`, `spring boot secret`, `aws secret cache`, `load db credentials from secrets manager`, and `rotate secret`.
25
26	## Instructions
27
28	### 1. Model the secret before writing access code
29
30	Decide:
31	- the secret name and path convention
32	- whether the value is plain text or structured JSON
33	- which application boundary is allowed to read it
34	- whether the caller needs the latest value on every request or can tolerate a cache
35
36	Prefer JSON secrets for multi-field credentials such as database connection details.
37
38	### 2. Create one reusable client per application configuration
39
40	Use a single `SecretsManagerClient` with explicit region and the default credential provider chain unless the environment requires something more specific.
41
42	Keep client creation in configuration code, not in business services.
43
44	### 3. Retrieve and deserialize at the boundary layer
45
46	At the integration boundary:
47	- fetch with `GetSecretValueRequest`
48	- deserialize JSON into a typed object or validated map
49	- convert AWS exceptions into application-level errors
50	- never log `secretString()` or include it in thrown exception messages
51
52	### 4. Add caching only where it solves a real problem
53
54	Use caching when:
55	- the secret is read frequently
56	- latency matters for startup or request handling
57	- the cost of repeated lookups is material
58
59	Document cache TTL expectations clearly, especially if the secret rotates.
60
61	### 5. Design for rotation and staged versions
62
63	If the secret rotates:
64	- read through a thin service layer so cache invalidation and retry behavior stay centralized
65	- understand which callers must tolerate `AWSPENDING` during verification workflows
66	- test how the application behaves during stale cache windows or partial rotation failures
67
68	### 6. Validate end-to-end behavior
69
70	Before shipping:
71	- verify IAM permissions and KMS access
72	- test missing secret, wrong region, and decryption failure paths
73	- confirm secrets are not surfaced in logs, metrics, or debug endpoints
74	- prove database or API clients refresh correctly when credentials rotate
75
76	## Examples
77
78	### Example 1: Reusable client and typed secret lookup
79
80	```java
81	@Configuration
82	public class SecretsConfiguration {
83
84	@Bean
85	SecretsManagerClient secretsManagerClient() {
86	return SecretsManagerClient.builder()
87	.region(Region.of("eu-south-2"))
88	.credentialsProvider(DefaultCredentialsProvider.create())
89	.build();
90	}
91	}
92
93	@Service
94	public class SecretsService {
95
96	private final SecretsManagerClient client;
97	private final ObjectMapper objectMapper;
98
99	public SecretsService(SecretsManagerClient client, ObjectMapper objectMapper) {
100	this.client = client;
101	this.objectMapper = objectMapper;
102	}
103
104	public DatabaseSecret loadDatabaseSecret(String secretId) throws JsonProcessingException {
105	GetSecretValueResponse response = client.getSecretValue(
106	GetSecretValueRequest.builder().secretId(secretId).build()
107	);
108	return objectMapper.readValue(response.secretString(), DatabaseSecret.class);
109	}
110	}
111	```
112
113	### Example 2: Cache a hot-path secret lookup
114
115	```java
116	public class CachedSecretsService {
117
118	private final SecretCache cache;
119
120	public CachedSecretsService(SecretsManagerClient client) {
121	this.cache = new SecretCache(client);
122	}
123
124	public String apiToken(String secretId) {
125	return cache.getSecretString(secretId);
126	}
127	}
128	```
129
130	Use this pattern only when the application can tolerate the chosen cache refresh behavior.
131
132	## Best Practices
133
134	- Use hierarchical secret names that match domain and environment boundaries.
135	- Prefer typed JSON d

People who liked this also viewed

6 picks

Type