> For the complete documentation index, see [llms.txt](https://mercure-technologies.gitbook.io/xprem/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://mercure-technologies.gitbook.io/xprem/key-store/aws-secrets-manager.md).

# AWS Secrets Manager

AWS Secrets Manager can hold every secret the server needs: the master key, the signing keys of your apps, and the CloudFront private key.

### Give the server access to AWS

Before anything else, the server needs to be able to call Secrets Manager. Set the region:

```dotenv
AWS_REGION=your-region
```

For credentials, you have two options:

* **The runtime's IAM role** — if the server runs on AWS (EC2, ECS, EKS…), it picks up the role automatically and there is nothing else to set.
* **An access key pair** — otherwise, provide static credentials:

```dotenv
AWS_ACCESS_KEY_ID=your-access-key-id
AWS_SECRET_ACCESS_KEY=your-secret-access-key
```

Either way, grant the identity `secretsmanager:GetSecretValue` on every secret you reference below. The same credentials are also used for [S3 Storage](/xprem/storage/s3-storage.md), so a single identity can cover both.

### The master key

Instead of putting the base64 master key in `DB_KEYS_MASTER_KEY_B64`, store it in a secret and reference it:

```dotenv
AWSSM_DB_KEYS_MASTER_KEY_SECRET_ID=name-of-the-master-key-secret
```

Remember that the server expects exactly one of the two master-key variables — setting both, or neither, prevents it from starting.

### The signing keys of an app

Choose `aws-secrets-manager` when creating the app, and provide the IDs of its existing public and private key secrets. The database then stores no key material for that app — see [Keys](/xprem/key-store/keys.md) for how the per-app stores work.

### The CloudFront private key

If you use [CloudFront](/xprem/cdn/cloudfront.md), store its private key in a secret and reference it:

```dotenv
AWSSM_CLOUDFRONT_PRIVATE_KEY_SECRET_ID=name-of-the-cloudfront-private-key-secret
```

When `KEYS_STORAGE_TYPE` is unset, this secret is the first source tried; if the variable is set, the source it selects wins — the full rule is on [Keys](/xprem/key-store/keys.md).


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://mercure-technologies.gitbook.io/xprem/key-store/aws-secrets-manager.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.