When calling an operation from the AWS PHP SDK, is there a way to secure its payload contents in a non-readable format?

Question

I've recently used the PHP SDK to test some operations under the SecretsManager service. Everything works fine. However, I needed to ensure the information sent in using the **`createSecret`** operation was safe from any third-party threats.

So I did a small investigation to view the request's body contents. I was able to view this content under ***StreamRequestPayloadMiddleware.php***.

After modifying it by using **json_decode **to view the request's contents, I came across this:
```
array(4) { 
	["Name"]=> string(9) "demo/Test" 
	["SecretString"]=> string(39) "{"username":"Tom","password":"Test123"}" 
	["KmsKeyId"]=> string(xx) "arn:aws:kms:xx-xxxx-x:xxxxxxxxxx:key/xxx-xxx-xxx-xxx-xxxxxxxxxx" 
	["ClientRequestToken"]=> string(xx) "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" 
} 
```
I then realized the plaintext contents of the SecretString were visible in the request's body.

I'm aware the SecretsManager uses a KMS key to encrypt the secret values; however, this only happens once the operation has been sent to the server-side (AWS Console).

Therefore, I need to know if there is any way to protect the payload contents in an **encrypted format** so that the SecretsManager service or AWS can **unpack this content to its original value** without having it saved in that encrypted format, on a new secret.

Answer

> I needed to ensure the information sent in using the createSecret operation was safe from any third-party threats.

If you're concerned about over-the-wire threats (e.g. MITM), then you don't need to do anything. The payload will be encrypted via TLS which prevents third parties from being able to view the data.

Otherwise, there isn't an out-of-the-box mechanism to achieve this. You could send a client-side encrypted payload to a Lambda Function, and have the Function decrypt it and perform the `createSecret` operation.

When calling an operation from the AWS PHP SDK, is there a way to secure its payload contents in a non-readable format?

Relevant content