- [Hong] Hello! Hong here. In this video, I'm going to do a demo to show how you can create and store a secret in AWS Secrets Manager. Let's get started. From the AWS Management Console, you can search for Secrets Manager to start using the AWS Secrets Manager. On the right-hand side, you can store a new secret. Click on this button, and you have multiple options to create the secret, right? You can choose to create a credential or secret for RDS, for Redshift, for other type of database. You can also choose to store an API key. In this demo, we're gonna start with creating credentials for an RDS database. So, the credentials in this case will be the username and a password for the database admin to log in to the RDS instance. In this case, I'm going to create a username Admin, and the password I can just pick a simple password, right? t#st@ccount. But, you want to make sure that the password for your production database needs to be following the best practice, right? That's including special character with appropriate length. So, in this case, I can choose to use DefaultEncryptionKey, which is the KMS key created in your AWS account. I can choose to use my old KMS key that I created in KMS. I'm just going to stick with the DefaultEncryptionKey, and, this is grand magic happening, you can see that Secrets Manager automatically pulls out the database instance name that you want to associate the username and password with, and I have one, testauroradb, which is an Aurora instance available in the same Region that I'm storing this secret, which is the Oregon Region. So, let's click on Next, and in this case, it asks you, "What is the secret's name?" In this case, I'm going to name it DBAdmin, and for a description I will say, user name and password for our beloved database admin. Done. Now, for tags. Tagging is one of the best practices that we recommend for you to control your AWS resources. So in this case, I'm going to tag Department, and the value would be IT, because we want to control which resource is created by and maintained by which department. Click on Next. And, this is the fun part. You can choose to automatically rotate your secret unless you get a manager to do that for you. In this case, I'm going to choose Enable automatic rotation. You can choose 90 days rotation, 60 days. I'm going to stick with 90 day rotation, and you can use a Lamda function to perform the rotation for you. I don't have a Lamda function right now, so I'm going to let Secrets Manager create a new Lambda function for me. And, I'm going to name it, DBAdmin-secret-rotation. Awesome. And this Lambda will be used to rotate this specific secret. Click on Next. And now, it's just the Review, right? Which you use to store credentials in Secrets Manager for RDS database. We choose the DefaultEncryptionKey. We choose to name it as a DBAdmin, and now Secrets Manager gives you some sample code that you can integrate with you application. So if you look at the Python code, right, it's just like, "Hey, there's a function called get_secret", so that you talk to the imported Secrets Manager to pull out a secret for you in the application. And finally, we click on Store. And bam! Here you go. You have a new secret called DBAdmin, stored and rotated by AWS Secrets Manager. So, that's it for now, folks. Thanks for watching.