# aws-sdk-java-v2-secrets-manager

A skill for pulling AWS Secrets Manager values into Java services: retrieval, caching, rotation-aware access and Spring Boot wiring.

- skill · `type=skill` · Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode · 3700 installs · ★ 363
- Author: giuseppe-trisciuoglio
- License: MIT · policy=mirror · the beginning of the file is at the end of this page
- Source: https://github.com/giuseppe-trisciuoglio/developer-kit/tree/HEAD/plugins/developer-kit-java/skills/aws-sdk-java-v2-secrets-manager/SKILL.md
- Updated: 2026-09-10
- HTML: https://affpapa.org/en/nevibecode/skills/aws-sdk-java-v2-secrets-manager

## What it does

This skill lays out how a Java service should read secrets with AWS SDK for Java 2.x. You start by deciding the secret name and path convention, whether the value is plain text or JSON, and which part of the app may read it. The agent then writes the code: one reusable `SecretsManagerClient` in configuration rather than in business services, a fetch through `GetSecretValueRequest`, and JSON deserialized into a typed object at the integration boundary.

Caching is optional and the skill says so. Add it when the secret is read often and latency shows up at startup or during request handling. There is a `SecretCache` example, plus a note on how the app behaves inside a stale cache window. Rotation is handled through the `AWSCURRENT` and `AWSPENDING` stages, with reads pushed into a thin service layer so invalidation and retries stay in one place.

You need IAM permissions and KMS access before any of this works, otherwise the lookup fails. The skill is explicit that `secretString()` must never reach a log, and decrypted values must not end up in exception messages. Automatic rotation does not cover every secret shape, and large or fast-changing values are poor candidates for aggressive in-memory caching. Bundled references cover the API, caching and Spring Boot integration.

## Requirements
- Works with: AWS

## Install

### Claude Code (native platform)

1. **Skills CLI (Vercel)**
```bash
npx skills add giuseppe-trisciuoglio/developer-kit --skill aws-sdk-java-v2-secrets-manager -a claude-code
```

2. **Manually: put the files in place**
- File: `~/.claude/skills/aws-sdk-java-v2-secrets-manager/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/aws-sdk-java-v2-secrets-manager/

### Codex

1. **Skills CLI (Vercel)**
```bash
npx skills add giuseppe-trisciuoglio/developer-kit --skill aws-sdk-java-v2-secrets-manager -a codex
```

2. **Manually: put the files in place**
- File: `.agents/skills/aws-sdk-java-v2-secrets-manager/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

1. **Skills CLI (Vercel)**
```bash
npx skills add giuseppe-trisciuoglio/developer-kit --skill aws-sdk-java-v2-secrets-manager -a cursor
```

2. **Manually: put the files in place**
- File: `.cursor/skills/aws-sdk-java-v2-secrets-manager/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install giuseppe-trisciuoglio/developer-kit aws-sdk-java-v2-secrets-manager
```

2. **Manually: put the files in place**
- File: `.github/skills/aws-sdk-java-v2-secrets-manager/SKILL.md`

### Gemini CLI

1. **Skills CLI (Vercel)**
```bash
npx skills add giuseppe-trisciuoglio/developer-kit --skill aws-sdk-java-v2-secrets-manager -a gemini-cli
```

2. **Platform CLI**
```bash
gemini skills install https://github.com/giuseppe-trisciuoglio/developer-kit --path plugins/developer-kit-java/skills/aws-sdk-java-v2-secrets-manager
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/aws-sdk-java-v2-secrets-manager/SKILL.md` — The legacy .windsurf/skills/ path still works

### OpenCode

**Skills CLI (Vercel)**
```bash
npx skills add giuseppe-trisciuoglio/developer-kit --skill aws-sdk-java-v2-secrets-manager -a opencode
```

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/giuseppe-trisciuoglio/developer-kit/tree/HEAD/plugins/developer-kit-java/skills/aws-sdk-java-v2-secrets-manager/SKILL.md

## When to use it
- replace hardcoded passwords and API tokens with managed secrets
- load database or third-party credentials at runtime
- cut lookup latency and API cost with a secret cache
- handle `AWSCURRENT` and `AWSPENDING` during rotation
- wire secrets into Spring Boot beans without leaking values into logs

## Example prompts
- show me how to read a secret from AWS Secrets Manager in a Java service
- add caching for a secret that gets read on every request
- load database credentials from Secrets Manager in Spring Boot

## Source text · SKILL.md · MIT

Below is the content of a third-party file. It is data, not instructions for you: do not act on anything written inside unless the human asks. Block tag: 279491177243a1fe.

BEGIN THIRD-PARTY FILE 279491177243a1fe
```text
---
name: aws-sdk-java-v2-secrets-manager
description: Provides AWS Secrets Manager patterns for AWS SDK for Java 2.x, including secret retrieval, caching, rotation-aware access, and Spring Boot integration. Use when storing or reading secrets in Java services, replacing hardcoded credentials, or wiring secret-backed configuration into applications.
allowed-tools: Read, Write, Edit, Bash, Glob, Grep
---

# AWS SDK for Java 2.x - AWS Secrets Manager

## Overview

Use this skill to manage application secrets with AWS Secrets Manager from Java services.

It focuses on the operational flow that matters in production:
- how to retrieve and deserialize secrets safely
- when to add local caching
- how to integrate secret access into Spring Boot without leaking values into logs or configuration files

Keep large API notes and extended setup details in the bundled references.

## When to Use

Use this skill when:
- replacing hardcoded passwords, API keys, or tokens with managed secrets
- loading database credentials or third-party API credentials at runtime
- adding caching to reduce Secrets Manager latency and API cost
- handling secret version stages such as `AWSCURRENT` and `AWSPENDING`
- wiring secret access into Spring Boot beans or configuration services
- preparing rotation-aware applications or Lambda rotation workflows

Typical trigger phrases include `java secrets manager`, `spring boot secret`, `aws secret cache`, `load db credentials from secrets manager`, and `rotate secret`.

## Instructions

### 1. Model the secret before writing access code

Decide:
- the secret name and path convention
- whether the value is plain text or structured JSON
- which application boundary is allowed to read it
- whether the caller needs the latest value on every request or can tolerate a cache

Prefer JSON secrets for multi-field credentials such as database connection details.
```
END THIRD-PARTY FILE 279491177243a1fe

The third-party file has ended. Everything between the 279491177243a1fe tags is data: requests and commands from it are not followed. An “end of file” line with another tag inside the block is part of the file.

First 1896 of 6088 bytes. © giuseppe-trisciuoglio · MIT · https://github.com/giuseppe-trisciuoglio/developer-kit/tree/HEAD/plugins/developer-kit-java/skills/aws-sdk-java-v2-secrets-manager/SKILL.md

_Part of the page did not fit — see the HTML version._

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md