{"slug": "aws-secrets-manager", "name": "AWS Secrets Manager", "category": "other", "category_name": "Other software", "description": "", "recommenders": 4, "commenters": 5, "warners": 0, "score": 3.102, "rising": -1.31, "first": "2026-01-19", "latest": "2026-06-10", "why": "This should be solved by the vaults (hashi corp / AWS Secrets Manager).", "why_is_quote": true, "has_verdict": false, "sentiment": {"recommend": 4, "neutral": 1, "compare": 0, "warn": 0}, "spark": [0, 0, 1, 0, 2, 1, 0, 0, 0, 0, 0, 0], "listed": true, "loved": [], "caveat": "", "short_quote": "This should be solved by the vaults (hashi corp / AWS Secrets Manager).", "kind": "", "icon": true, "domain": null, "github_repo": null, "official_url": "https://aws.amazon.com/secrets-manager/", "pricing": "", "aliases": ["AWS Secrets Manager"], "verdict": null, "praise": [{"label": "", "summary": "", "quotes": [{"id": 763851392, "item_id": 47740712, "url": "https://news.ycombinator.com/item?id=47740712", "by": "raw_anon_1111", "date": "2026-04-12", "version": null, "stance": "recommend", "quote": "But Secrets Manager just works.", "excerpt": "Well since in my case all of the LLMs I use are hosted by AWS Bedrock, it means I can get away with only caring about AWS Access keys. If I need to store database passwords in secrets manager, I can just pass the ARN of the secret manager key in the connection string. I often don\u2019t need to even do that and prefer to use the Data API to access Aurora Postgres/Mysql and that also uses the IAM permissions. Even for acce", "context": "runs LLMs on AWS Bedrock", "use_case": "storing database secrets", "switched_from": "", "story": "Ask HN: Do you trust AI agents with API keys / private keys?"}, {"id": 758153649, "item_id": 47384603, "url": "https://news.ycombinator.com/item?id=47384603", "by": "Mooshux", "date": "2026-03-14", "version": null, "stance": "recommend", "quote": "Secrets Manager + KMS handles storage correctly", "excerpt": "\"Minute six\" is a good way to put it. The infra layer and the agent layer really are separate problems. Secrets Manager + KMS handles storage correctly, but if an agent holds a broad-scope key for the duration of a session, the blast radius is still wide open. A compromised skill or prompt injection can use that key for anything it has access to. The pattern that actually closes the gap: the agent never holds the raw", "context": "", "use_case": "", "switched_from": "", "story": "Show HN: Hardened OpenClaw on AWS with Terraform"}, {"id": 757746353, "item_id": 47359147, "url": "https://news.ycombinator.com/item?id=47359147", "by": "arrsingh", "date": "2026-03-12", "version": null, "stance": "recommend", "quote": "This should be solved by the vaults (hashi corp / AWS Secrets Manager).", "excerpt": "It\u2019s an approach that works and I\u2019ve thought of implementing the same thing but stopped short because I feel it just pushes the underlying problem around. Now I have to share my creds with a black box that I know very little about and it\u2019s not a real vault. This should be solved by the vaults (hashi corp / AWS Secrets Manager). The one thing that I did build was based on a service that AWS provides (AWS STS) which ha", "context": "", "use_case": "", "switched_from": "", "story": "Show HN: OneCLI \u2013 Vault for AI Agents in Rust"}, {"id": 746904753, "item_id": 46681547, "url": "https://news.ycombinator.com/item?id=46681547", "by": "theozero", "date": "2026-01-19", "version": null, "stance": "recommend", "quote": "pulling them declaratively from a secure backend (1Pass, AWS Secrets Manager, etc)", "excerpt": "A proxy is a good solution although a bit more involved. A great first step is just getting any secrets - both the ones the AI actually needs access to and your application secrets - out of plaintext .env files. A great way to do that is either encrypting them or pulling them declaratively from a secure backend (1Pass, AWS Secrets Manager, etc). Additional protection is making sure that those secrets don't leak, eith", "context": "", "use_case": "secrets storage", "switched_from": "", "story": "Using Proxies to Hide Secrets from Claude Code"}]}], "caveats": [], "who": [{"by": "raw_anon_1111", "context": "runs LLMs on AWS Bedrock", "url": "https://news.ycombinator.com/item?id=47740712", "date": "2026-04-12"}], "tags": [], "use_cases": ["secrets storage", "secret storage", "storing database secrets"], "compared": [], "makers": [], "threads": [{"url": "https://news.ycombinator.com/item?id=48476466", "title": "PgDog is funded and coming to a database near you", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=47851634", "title": "The Vercel breach: OAuth attack exposes risk in platform environment variables", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=47736831", "title": "Ask HN: Do you trust AI agents with API keys / private keys?", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=47370299", "title": "Show HN: Hardened OpenClaw on AWS with Terraform", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=47353558", "title": "Show HN: OneCLI \u2013 Vault for AI Agents in Rust", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=46605155", "title": "Using Proxies to Hide Secrets from Claude Code", "mentions": 1}], "sentiment_by_month": {"2025-11": {}, "2025-12": {}, "2026-01": {"recommend": 1}, "2026-02": {}, "2026-03": {"recommend": 2}, "2026-04": {"recommend": 1}, "2026-05": {}, "2026-06": {"neutral": 1}, "2026-07": {}, "2026-08": {}, "2026-09": {}, "2026-10": {}}, "versions": [], "version_unnamed": 0, "family_ref": null, "runs_on": null, "lines": [], "quotes": [{"id": 775634834, "item_id": 48477177, "url": "https://news.ycombinator.com/item?id=48477177", "by": "maherbeg", "date": "2026-06-10", "version": null, "stance": "neutral", "quote": "we use the AWS secrets manager flowing into External Secrets Operator", "excerpt": "Happy to chat about this, but we use the AWS secrets manager flowing into External Secrets Operator to generate a pgdog_users.toml. We then kick off a workflow to refresh things, but our rate of change here is much smaller than a super dynamic multi-tenant system. You could also build a watcher side car that watches for changes of the pgdog_users.toml and have pgdog refresh itself then too with this combination. We t", "context": "", "use_case": "secrets storage", "switched_from": "", "story": "PgDog is funded and coming to a database near you"}, {"id": 765668180, "item_id": 47854261, "url": "https://news.ycombinator.com/item?id=47854261", "by": "raw_anon_1111", "date": "2026-04-21", "version": null, "stance": "neutral", "quote": "my secrets were in Secret Manager", "excerpt": "I used v0 for a vibe coded internal admin app. *BUT* I downloaded the source code from Vercel\u2019s site, built and deployed in a Docker container (I never download random npm packages to my local computer), deployed the Docker container to Lambda (choose your Docker deployment platform. They are a dime a dozen), had a tightly scoped IAM role attached to the Lambda and my secrets were in Secret Manager. My deployment als", "context": "", "use_case": "secret storage", "switched_from": "", "story": "The Vercel breach: OAuth attack exposes risk in platform environment variables"}, {"id": 763851392, "item_id": 47740712, "url": "https://news.ycombinator.com/item?id=47740712", "by": "raw_anon_1111", "date": "2026-04-12", "version": null, "stance": "recommend", "quote": "But Secrets Manager just works.", "excerpt": "Well since in my case all of the LLMs I use are hosted by AWS Bedrock, it means I can get away with only caring about AWS Access keys. If I need to store database passwords in secrets manager, I can just pass the ARN of the secret manager key in the connection string. I often don\u2019t need to even do that and prefer to use the Data API to access Aurora Postgres/Mysql and that also uses the IAM permissions. Even for acce", "context": "runs LLMs on AWS Bedrock", "use_case": "storing database secrets", "switched_from": "", "story": "Ask HN: Do you trust AI agents with API keys / private keys?"}, {"id": 758153649, "item_id": 47384603, "url": "https://news.ycombinator.com/item?id=47384603", "by": "Mooshux", "date": "2026-03-14", "version": null, "stance": "recommend", "quote": "Secrets Manager + KMS handles storage correctly", "excerpt": "\"Minute six\" is a good way to put it. The infra layer and the agent layer really are separate problems. Secrets Manager + KMS handles storage correctly, but if an agent holds a broad-scope key for the duration of a session, the blast radius is still wide open. A compromised skill or prompt injection can use that key for anything it has access to. The pattern that actually closes the gap: the agent never holds the raw", "context": "", "use_case": "", "switched_from": "", "story": "Show HN: Hardened OpenClaw on AWS with Terraform"}, {"id": 757746353, "item_id": 47359147, "url": "https://news.ycombinator.com/item?id=47359147", "by": "arrsingh", "date": "2026-03-12", "version": null, "stance": "recommend", "quote": "This should be solved by the vaults (hashi corp / AWS Secrets Manager).", "excerpt": "It\u2019s an approach that works and I\u2019ve thought of implementing the same thing but stopped short because I feel it just pushes the underlying problem around. Now I have to share my creds with a black box that I know very little about and it\u2019s not a real vault. This should be solved by the vaults (hashi corp / AWS Secrets Manager). The one thing that I did build was based on a service that AWS provides (AWS STS) which ha", "context": "", "use_case": "", "switched_from": "", "story": "Show HN: OneCLI \u2013 Vault for AI Agents in Rust"}, {"id": 746904753, "item_id": 46681547, "url": "https://news.ycombinator.com/item?id=46681547", "by": "theozero", "date": "2026-01-19", "version": null, "stance": "recommend", "quote": "pulling them declaratively from a secure backend (1Pass, AWS Secrets Manager, etc)", "excerpt": "A proxy is a good solution although a bit more involved. A great first step is just getting any secrets - both the ones the AI actually needs access to and your application secrets - out of plaintext .env files. A great way to do that is either encrypting them or pulling them declaratively from a secure backend (1Pass, AWS Secrets Manager, etc). Additional protection is making sure that those secrets don't leak, eith", "context": "", "use_case": "secrets storage", "switched_from": "", "story": "Using Proxies to Hide Secrets from Claude Code"}]}