AWS Secrets Manager with boto3 in python

Question

I've heard that it's not a best practice to use aws configure to store secrets in a config file on my machine, which totally makes sense.  How do I use AWS Secrets manager to get the keys when connecting to AWS requires keys in the first place?  Does my question make sense?  Would this code work?  https://boto3.amazonaws.com/v1/documentation/api/latest/guide/secrets-manager.html

jsonc · Accepted Answer

Good question!

What you may see if you're running things locally is to put the initial credentials into your configuration file locally.  However, there is still an authentication need - to authenticate into an IAM entity that has access to AWS, for example an IAM User or IAM role.

If your application is running in AWS, that's where the integration of AWS IAM and Secrets Management is fantastic.  For example, if your app is running on an ec2, the ec2 IAM Role will need IAM permissions to access the Secret (also considering Secret Resource policy and KMS as needed) and can retrieve it programatically using CLI or Boto3 like the link you've shared: https://repost.aws/questions/QUAsOpdhR-QAKVZEL0nRGTkw/aws-secrets-manager-with-boto-3-in-python.

vlttnv · Answer

It depends how you are executing the code that is retrieving the secrets.  
For example if you are executing your python script from an EC2 machine, you assign an [IAM role](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-roles-for-amazon-ec2.html) to the machine which gives it access to Secrets Manager. Boto3 will automatically pick up the permissions and you wont need to supply credentials.

AWS Secrets Manager with boto3 in python

Relevant content