hands-on labMigrating Hard-coded Secrets in AWS Lambda to AWS Secrets Manager
1h 20m
Get guided in a real environmentPractice with a step-by-step scenario in a real, provisioned environment.
Learn and validateUse validations to check your solutions every step of the way.
See resultsTrack your knowledge and monitor your progress.
Lab steps
Logging In to the Amazon Web Services Console
Making a Simple API Call with AWS Lambda
Migrating a Hard-coded Secret to AWS Secrets Manager
Retrieving a Secret from AWS Secrets Manager with AWS Lambda
Lab description

AWS Secrets Manager is a fully managed service for managing sensitive digital credentials. Types of secrets that can be managed with AWS Secrets Manager include API keys, passwords, tokens, and certificates. AWS Secrets Manager also addresses the security and maintenance concerns that come with hardcoding sensitive pieces of data directly in your code.

With AWS Secrets Manager, you can replace hard-coded credentials in your code by retrieving the secret programmatically using an AWS Secrets API call.

In this lab, you will migrate a hard-coded API key in an AWS Lambda function to AWS Secrets Manager and update the function code to follow a secure pattern that is also easy to maintain.

Learning Objectives

Upon completion of this lab, you will be able to:

  • Store a secret in AWS Secrets Manager
  • Access a secret from an AWS Lambda function

Intended Audience

  • Candidates for the AWS Certified Solutions Architect - Associate exam
  • Cloud Architects
  • Software Engineers


Familiarity with the following will be beneficial but is not required:

  • Secret Management
  • The Python programming language
  • The Linux command line

The following courses and labs can be used to fulfill the prerequisite:


April 24th, 2023 - Updated the instructions and screenshots to the latest UI

Environment before
environment before preview
Environment after
environment after preview
About the author
Jun Fritz
Cloud Labs Developer
Learning Paths

Jun is a Cloud Labs Developer with previous experience as a Software Engineer and Cloud Developer. He holds the AWS Certified Solutions Architect and DevOps Engineer Professional certifications. He also holds the AWS Certified Solutions Architect, Developer, and SysOps Administrator Associate certifications. 

Jun is focused on giving back to the growing cloud community by sharing his knowledge and experience with students and creating engaging content. 

Covered topics