Ravindra BagaleCourses & study guides मराठी Track your progress

AWS CLI Secrets Manager and SSM Parameter Store Commands

By , trainer LinkedIn Last updated:

We keep passwords out of code: Secrets Manager for secrets with rotation, Parameter Store for config, and SSM to run commands and open shells without SSH.

What you'll learn in this chapter

  • Create and read a secret
  • Update and rotate
  • Parameter Store values
  • Run Command
  • Session Manager

1. The big picture: a bank locker

Why do we need this?

You keep jewellery in a bank locker, not under the bed, and the bank logs every visit. Secrets Manager and Parameter Store are lockers for passwords and settings, with IAM deciding who opens them.

What is it?

Secrets use aws secretsmanager. Parameters, Run Command and sessions use aws ssm.

How to do it (step by step)

Secret workflowcreate-secretapp reads get-secret-valueput-secret-value / rotatessm put-parameter for configssm send-command / start-session
Never echo secrets into shell history or logs.

2. Create and read a secret

Why do we need this?

A DB password in code ends up in Git and everyone sees it.

What is it?

create-secret stores a string or JSON encrypted with KMS. get-secret-value returns the current version.

How to do it (step by step)

  1. Create from a file.
printf '{"user":"app","pass":"S3cr3t!"}' > db.json
aws secretsmanager create-secret --name cli/db --secret-string file://db.json --query ARN --output text
rm db.json

Expected output:

arn:aws:secretsmanager:ap-south-1:111122223333:secret:cli/db-AbCdEf
  1. Read one field.
aws secretsmanager get-secret-value --secret-id cli/db --query SecretString --output text | jq -r .user

Expected output:

app

3. Update and rotate

Why do we need this?

Passwords must change regularly without breaking the app.

What is it?

put-secret-value adds a new AWSCURRENT version. rotate-secret calls a Lambda on a schedule (RDS has ready-made ones).

How to do it (step by step)

  1. Put a new value.
aws secretsmanager put-secret-value --secret-id cli/db --secret-string '{"user":"app","pass":"N3w!"}' --query VersionStages --output text

Expected output:

AWSCURRENT
  1. Turn on 30-day rotation.
aws secretsmanager rotate-secret --secret-id cli/db --rotation-lambda-arn arn:aws:lambda:ap-south-1:111122223333:function:rotate-db --rotation-rules AutomaticallyAfterDays=30 --query VersionId --output text

Expected output:

7e8f9a0b-...

4. Parameter Store

Why do we need this?

Settings like the API URL differ for dev and prod, and some must be encrypted.

What is it?

put-parameter stores String, StringList or SecureString in a path like /app/dev/url. get-parameters-by-path reads a whole folder. Standard parameters are free.

How to do it (step by step)

  1. Store values.
aws ssm put-parameter --name /cli/dev/url --type String --value https://api.dev.example.com
aws ssm put-parameter --name /cli/dev/key --type SecureString --value abc123 --query Version --output text

Expected output:

1
  1. Read a folder with decryption.
aws ssm get-parameters-by-path --path /cli/dev --with-decryption --query "Parameters[].[Name,Value]" --output text

Expected output:

/cli/dev/key  abc123
/cli/dev/url  https://api.dev.example.com

5. Run Command and Session Manager

Why do we need this?

You need to patch 50 servers or get a shell, with port 22 closed.

What is it?

Instances with the SSM agent and AmazonSSMManagedInstanceCore can take send-command. start-session opens a shell through AWS (needs the Session Manager plugin).

How to do it (step by step)

  1. List managed instances.
aws ssm describe-instance-information --query "InstanceInformationList[].[InstanceId,PingStatus]" --output text

Expected output:

i-0abc123def4567890  Online
  1. Run a command on tagged servers.
C=$(aws ssm send-command --document-name AWS-RunShellScript --targets Key=tag:env,Values=dev --parameters commands="uptime" --query Command.CommandId --output text)
sleep 5; aws ssm list-command-invocations --command-id $C --details --query "CommandInvocations[].CommandPlugins[0].Output" --output text

Expected output:

 06:10:01 up 3 days,  2:14,  0 users,  load average: 0.01
  1. Open a shell.
aws ssm start-session --target i-0abc123def4567890

Expected output:

Starting session with SessionId: you-0a1b2c3d
sh-5.2$

6. Same action in Python, Node.js, Java, Go, .NET and PHP

Why do we need this?

Scripts start in the CLI. Apps call the same API through an SDK. Knowing both helps you move a tested command into real code.

What is it?

Each CLI command maps to one API call. For example aws secretsmanager get-secret-value --secret-id cli/db maps to the Get secret API.

How to do it (step by step)

Same action (Get secret) from code. Every SDK reads the same profile, region and credentials as the CLI.

StackCode
Python (boto3)boto3.client("secretsmanager").get_secret_value(SecretId="cli/db")["SecretString"]
Node.js (v3)await sm.send(new GetSecretValueCommand({SecretId:"cli/db"}));
Java (v2)sm.getSecretValue(r -> r.secretId("cli/db")).secretString();
Go (v2)c.GetSecretValue(ctx, &secretsmanager.GetSecretValueInput{SecretId: aws.String("cli/db")})
.NETawait sm.GetSecretValueAsync(new GetSecretValueRequest{SecretId="cli/db"});
PHP$sm->getSecretValue(["SecretId"=>"cli/db"])["SecretString"];

7. Clean up so nothing keeps costing

Why do we need this?

Lab resources left running cost money and can be a security risk.

What is it?

Delete in reverse order: children first, then parents.

How to do it (step by step)

  1. Delete the secret (7-day recovery window).
aws secretsmanager delete-secret --secret-id cli/db --recovery-window-in-days 7 --query DeletionDate --output text

Expected output:

2026-10-31T11:00:00+05:30
  1. Delete parameters.
aws ssm delete-parameters --names /cli/dev/url /cli/dev/key --query DeletedParameters --output text

Expected output:

/cli/dev/url  /cli/dev/key
  1. Verify.
aws ssm get-parameters-by-path --path /cli/dev --query Parameters

Expected output:

[]

Ravindra Bagale's Tip

Read secrets into a variable, not onto the command line, and never print them in CI logs. Use --secret-string file:// so the value is not in shell history.

8. Interview questions and answers

Q. Secrets Manager vs Parameter Store?

Secrets Manager has rotation and cross-account sharing at a cost per secret. Parameter Store is free for standard and good for config.

Q. What is SecureString?

A parameter encrypted with KMS; read it with --with-decryption.

Q. Why Session Manager over SSH?

No open port 22, no keys, IAM-controlled and logged.

Q. What does an instance need for SSM?

The SSM agent, network to SSM and the AmazonSSMManagedInstanceCore role policy.

Q. Can you undo delete-secret?

Yes, restore-secret during the recovery window.

Try at home

  1. Store a DB URL in Parameter Store and a password in Secrets Manager; read both in a script.
  2. Run uptime on all dev instances with send-command.

In short

  1. create-secret.
  2. get-secret-value.
  3. put-parameter SecureString.
  4. send-command by tag.
  5. start-session, no SSH.

Practice Tasks

About this scenario

Milan Furniture is a furniture business in Milan. Giulia Rossi looks after its IT and cloud work. They count money in EUR and run their AWS resources in the eu-south-1 Region. In the tasks below you do real jobs for them using what this lesson teaches. All names, account IDs, IP addresses and numbers are made up for practice.

0 / 11

Easy Read a secret

Why: Apps read the secret at start-up instead of keeping it in a file.

What to do: Get the value of secret milanfurniture/prod/db.

How:
  1. Read the task and decide which AWS service it is about.
  2. Write aws, then the service name, then the operation (the action word).
  3. Add each needed flag (--name) followed by its value from the task.
  4. Flags can be in any order. Click Check answer.

Easy Port for SSH

Why: Security group rules need the right port.

What to do: Which TCP port must the security group open for SSH?

How:
  1. Write down the numbers the task gives you.
  2. Work it out step by step on paper.
  3. Type only the final answer in the box.
  4. Click Check answer.

Easy Port for MySQL

Why: The DB security group should open only this port, only to the app.

What to do: Milan Furniture's app talks to RDS MySQL. Which port should the DB security group allow?

How:
  1. Write down the numbers the task gives you.
  2. Work it out step by step on paper.
  3. Type only the final answer in the box.
  4. Click Check answer.

Medium Read a decrypted parameter

Why: Without --with-decryption you only see the encrypted blob.

What to do: Read /milanfurniture/prod/api-key and decrypt it.

How:
  1. Read the task and decide which AWS service it is about.
  2. Write aws, then the service name, then the operation (the action word).
  3. Add each needed flag (--name) followed by its value from the task.
  4. Flags can be in any order. Click Check answer.

Medium Store an encrypted parameter

Why: SecureString parameters are encrypted with KMS and are free for standard tier.

What to do: Store /milanfurniture/prod/api-key as a SecureString with the value abc123.

How:
  1. Read the task and decide which AWS service it is about.
  2. Write aws, then the service name, then the operation (the action word).
  3. Add each needed flag (--name) followed by its value from the task.
  4. Flags can be in any order. Click Check answer.

Medium Read one secret only

Why: Each app should read only its own secret.

What to do: Allow secretsmanager:GetSecretValue on arn:aws:secretsmanager:eu-south-1:126154182628:secret:milanfurniture/prod/db-* only.

How:
  1. Start with { "Version": "2012-10-17", "Statement": [ ... ] }.
  2. In each statement write Effect, Action and Resource.
  3. Give only what the task needs (least privilege).
  4. Use double quotes and commas correctly. Click Check answer.

Medium Store a database password

Why: Secrets Manager encrypts secrets and can rotate them; never put them in code.

What to do: Create secret milanfurniture/prod/db with the value from secret.json.

How:
  1. Read the task and decide which AWS service it is about.
  2. Write aws, then the service name, then the operation (the action word).
  3. Add each needed flag (--name) followed by its value from the task.
  4. Flags can be in any order. Click Check answer.

Medium CloudFormation: web security group

Why: Opening only 443 keeps the server safer.

What to do: Template with an AWS::EC2::SecurityGroup that allows TCP 443 from 0.0.0.0/0. Add a GroupDescription.

How:
  1. Start from the top-level keys the task names.
  2. Indent child keys with 2 spaces (no tabs).
  3. Fill in each property with the value from the task.
  4. Click Check answer. Key order does not matter.

Hard Read all parameters under a path

Why: A path groups config, like /app/prod/, so one call loads it all.

What to do: Get all parameters under /milanfurniture/prod, including sub-paths, decrypted.

How:
  1. Read the task and decide which AWS service it is about.
  2. Write aws, then the service name, then the operation (the action word).
  3. Add each needed flag (--name) followed by its value from the task.
  4. Flags can be in any order. Click Check answer.

Hard Rotate a secret now

Why: Rotation changes the password on a schedule or on demand.

What to do: Start rotation of secret milanfurniture/prod/db now.

How:
  1. Read the task and decide which AWS service it is about.
  2. Write aws, then the service name, then the operation (the action word).
  3. Add each needed flag (--name) followed by its value from the task.
  4. Flags can be in any order. Click Check answer.

Hard Deny access from outside the office

Why: An explicit Deny with aws:SourceIp blocks keys used from anywhere else.

What to do: Write one Deny statement: deny all actions (*) on all resources (*) when the source IP is NOT in 203.0.113.0/24.

How:
  1. Start with { "Version": "2012-10-17", "Statement": [ ... ] }.
  2. In each statement write Effect, Action and Resource.
  3. Give only what the task needs (least privilege).
  4. Use double quotes and commas correctly. Click Check answer.

See all practice tasks in the Task Hub →

Revision, comparison and interview cards

Revise this lesson in a few minutes. Save the cards on your phone or download them as PNG files. The QR code on each card opens this lesson.

Secrets Manager. Passwords go in a locker, not code. create-secret from a file. get-secret-value reads it. rotate-secret with a Lambda.
Revision card: Secrets Manager · Download PNG · Open card page
SSM Parameter Store. Config per env in paths. SecureString is KMS-encrypted. Read a folder with decryption. start-session replaces SSH.
Revision card: SSM Parameter Store · Download PNG · Open card page
Secrets Manager vs Parameter Store. Paid per secret. / Standard is free.
Comparison: Secrets Manager vs Parameter Store · Download PNG · Open card page
Secrets Manager vs Parameter Store?. Secrets Manager: rotation, paid per secret. Parameter Store: free standard config. Both encrypt with KMS.
Interview card: Secrets Manager vs Parameter Store? · Download PNG · Open card page

More cards: Ravi Sir's Cards.