Manage the RDS Database credentials using AWS Secret Manager and Monitor it thru CloudTrail
Tags: rds, cloudtrail, secretmanager
Published: 2023-03-15 20:48:03

# What is AWS Secrets Manager?

- As per AWS documentation 

- **AWS Secrets Manager** helps you protect secrets needed to access your applications, services, and IT resources. 
- The service enables you to easily rotate, manage, and retrieve database credentials, API keys, and other secrets throughout their lifecycle. 
- Users and applications retrieve secrets with a call to the Secrets Manager APIs, eliminating the need to hardcode sensitive information in plain text. 
- Secrets Manager offers secret rotation with built-in integration for Amazon RDS, Amazon Redshift, and Amazon DocumentDB. 
- Also, the service is extensible to other types of secrets, including API keys and OAuth tokens. 


Please visit my **[GitHub Repository for RDS articles](https://github.com/awsmine/RDS_projects)** on various topics being updated on constant basis.


_**Let’s get started!**_


# Objectives:

**1.** Sign in to AWS Management Console

**2.** Create RDS MySQL instance 

**3.** Store a new secret

**4.** Verify the secret created

**5.** Monitor secret manager activities thru CloudTrail 

**6.** Delete AWS resources
   

# Pre-requisites:
- AWS user account with admin access, not a root account.



# Resources Used:

- [What is Amazon Relational Database Service (Amazon RDS)?](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Welcome.html)

- [What is AWS Secrets Manager?](https://docs.aws.amazon.com/secretsmanager/latest/userguide/intro.html)

- [AWS Secrets Manager (AMS SSPS)](https://docs.aws.amazon.com/managedservices/latest/userguide/secrets-manager.html) 

- [Monitor AWS Secrets Manager secrets](https://docs.aws.amazon.com/secretsmanager/latest/userguide/monitoring.html)



# Steps for implementation to this project:

## 1. Sign in to AWS Management Console

-  SignIn to the AWS Management Console using username and password in the AWS Region as US East (N. Virginia) us-east-1

## 2. Create RDS MySQL instance 

- On the Amazon RDS Console, Create database, ***`Standard create`***, Engine type - ***`MySQL`***, Templates - ***`Free tier`***, Under Settings, DB instance identifier - ***`myrdsinstance`***, Master username - ***`admin`***, Master password - ***`admin1234`***, Confirm master password - ***`admin1234`***, DB instance class - ***`db.t2.micro`***, Allocated storage - ***`20 GB`***, Storage autoscaling - ***`uncheck Enable storage autoscaling`***, Take all defaults

- Create database


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/89xw6uaedxbrad3u6n46.png)



## 3. Store a new secret

- On the AWS Secrets Manager Console, Store a new secret, Under Secret type - Credentials for Amazon RDS database, Under Credentials - User name - ***`admin`***, Password - ***`admin1234`***, Encryption key - ***`aws/secretsmanager`***, Database - ***`myrdsinstance`*** 

- Next

- Secret name - ***`myrdssecret`***

- Next, Next

- Store


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/xl5h6qhkq0wi4ss3e55f.png)



## 4. Verify the secret created

- Click on ***`myrdssecret`***, Under Secret value - Retrieve secret value 


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/6nca2mo0kod9gciyk1tv.png)




## 5. Monitor secret manager activities thru CloudTrail 

- On the CloudTrail Console, in the left navigation tab - Event history



![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/bqh19x02h0hvtjql95d4.png)

- in the lookup attributes, select ***`Event name`*** and Enter event name as ***`GetSecretValue`***


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ptr6h2itooq42lpllvpu.png)




## 6. Delete AWS resources

- From the Amazon RDS Console, delete RDS database - ***`myrdsinstance`***



# What we have done so far

- We have successfully created a RDS MySQL instance, created and stored a secret and monitored secret manager activities thru CloudTrail