Amazon RDS PostgreSQL & AWS Secrets Manager Integration
31 minIntermediate
This creates billable resources. Run it in a dev environment and destroy it when you finish. Set a budget alarm first.
Success criteria
0 of 4
What you are building#
What are Amazon RDS and AWS Secrets Manager?#
- Amazon RDS (Relational Database Service): A fully managed relational database service. It handles hardware provisioning, database setup, patching, Multi-AZ high availability replication, and continuous automated backups.
- AWS Secrets Manager: A secure secret management service that allows you to replace hardcoded credentials in code with an API call to dynamically retrieve secrets. It automatically generates, encrypts, and rotates database credentials using AWS KMS (Key Management Service).
text
ZERO-TRUST DATABASE ARCHITECTURE
+-----------------------------------------------------------------------------------+
| AWS SECRETS MANAGER |
| Generates & Encrypts Credentials (KMS) -> DB Username, Password, Endpoint |
+----------------------------------------+------------------------------------------+
|
| Dynamic Secret Fetch via AWS API
v
+-----------------------------------------------------------------------------------+
| AWS EKS CLUSTER (Private Subnets) |
| Django Application Pods (Injects DB Password dynamically into memory) |
| |
| | |
| | Encrypted TCP Connection (Port 5432) |
| v |
| +-----------------------------------------------------------------------------+ |
| | AMAZON RDS POSTGRESQL 16 (Private DB Subnet Group — No Public Access) | |
| | - Primary Node (us-east-1a) <---> Standby Replica (us-east-1b Multi-AZ) | |
| +-----------------------------------------------------------------------------+ |
+-----------------------------------------------------------------------------------+Steps#
Step 1: Deploy RDS & Secrets Manager#
Terminal
cd 01-Infrastructure-Terraform/Lab04-RDS-SecretsManager
terraform init
terraform apply -auto-approveStep 2: Retrieve Secret Values via AWS CLI#
Terminal
aws secretsmanager get-secret-value --secret-id nti-devops/rds/credentials --query SecretString --output text | jq .Verify it worked#
Terminal
aws secretsmanager get-secret-value --secret-id nti-devops/rds/credentialsExpected Output:
json
{
"engine": "postgres",
"host": "nti-devops-postgres.c123456789.us-east-1.rds.amazonaws.com",
"port": 5432,
"dbname": "nti_db",
"username": "nti_admin",
"password": "SuperSecretRandomPassword123!"
}Clean up#
Run this even if you did not finish. Everything above is destroyable, and an account full of half-built experiments is how a surprise bill starts.
Destructive — This removes real resources. Check which environment you are in first.
Terminal
terraform destroy -auto-approve
# RDS leaves a final snapshot unless told otherwise; snapshots are billed:
aws rds describe-db-snapshots --snapshot-type manual --query 'DBSnapshots[].DBSnapshotIdentifier'
aws secretsmanager delete-secret --secret-id <name> --force-delete-without-recoveryCost of this lab: Partly billable. A db.t3.micro RDS instance is free for 12 months on a new account and ~$13/month after. AWS Secrets Manager is $0.40 per secret per month with no free tier — small, but it does not stop on its own.