AWS Secrets Manager introduces safe secrets handling in the Agent Toolkit for AWS
AI coding agents can now use AWS secrets at runtime without ever exposing plaintext values to the model, logs, or memory.
View original announcement →Visual Summary
graph TD
A{{Secret Safety Skill}}:::announced
B((AI Coding Agent)):::external
C([Skill Guidance Layer]):::feature
D([PreToolUse Hook]):::feature
E([Dynamic References]):::feature
F(asm-exec Child Process):::compute
G(AWS Secrets Manager):::storage
H((Developer)):::external
H ==>|"uses"| B
B ==>|"installs aws-core"| A
A -->|"steers agent"| C
A -->|"enforces blocks"| D
C -->|"constructs"| E
E -->|"resolved by"| F
F -->|"fetches secret"| G
D -.->|"blocks get-secret-value"| G
B -->|"clarifies intent"| H
classDef announced fill:#ff9900,stroke:#ec7211,color:#fff,font-weight:bold
classDef compute fill:#e3f2fd,stroke:#1565c0,color:#1565c0
classDef storage fill:#e8f5e9,stroke:#2e7d32,color:#2e7d32
classDef feature fill:#fff3e0,stroke:#e65100,color:#e65100
classDef external fill:#f5f5f5,stroke:#616161,color:#616161
What's New
AWS Secrets Manager has introduced a "secret safety skill" as part of the aws-core plugin in the open-source Agent Toolkit for AWS, enabling AI coding agents to consume secrets without ever exposing plaintext values to the model's context window, session logs, or agent memory. The feature addresses a longstanding risk where agents like Claude Code, Codex, or Cursor could retrieve and surface raw secret values during agentic workflows. The skill is available today across all AWS Regions where Secrets Manager is supported.
How It Works
- Skill guidance layer: The plugin teaches the AI agent to use
{{resolve:secretsmanager:<secret-id>:<field-type>:<json-key>:<version>}}dynamic references instead of callingget-secret-valuedirectly, so the model constructs commands that reference secrets symbolically rather than retrieving their plaintext values. - Runtime resolution via
asm-exec: A wrapper script (asm-exec) resolves the dynamic references to actual secret values only at execution time inside a child process that runs outside the agent process, ensuring plaintext values never enter the agent's context window or memory. - Structural enforcement via PreToolUse hook: A
PreToolUsehook automatically intercepts and blocks any attempt to callget-secret-valueorbatch-get-secret-valuethrough the AWS CLI, SDK, MCP tools, or the AWS Workload Credentials Provider daemon—requiring no manual configuration. - Intent clarification: When a secret is needed, the agent prompts the developer to clarify intent and constructs the appropriate command using the secret reference, rather than fetching and passing the raw value.
- Backend flexibility: Secret resolution supports either the AWS Workload Credentials Provider running on
localhost:2773or standard AWS credentials withsecretsmanager:GetSecretValueIAM permissions. - Zero-friction installation: Installing the
aws-coreplugin for the supported agent platform automatically activates both the skill guidance and the enforcement hook with no additional setup.
Why It's Important
- Eliminates a critical AI-era attack surface: Before this feature, any AI coding agent with shell or AWS API access could inadvertently (or maliciously) pull plaintext secrets into conversation history, logs, or downstream tool calls—a risk that grows as agentic workflows become more autonomous.
- Protects against accidental leakage in logs: Session logs and conversation histories are often stored, shared, or reviewed by multiple parties; keeping secrets out of these channels significantly reduces the blast radius of a potential exposure.
- Enforces least-privilege behavior at the agent layer: The structural hook ensures that even if the model is prompted or manipulated to request a secret value, the request is blocked automatically, adding a defense-in-depth layer on top of IAM policies.
- Enables secure adoption of agentic development: Organizations that have been hesitant to allow AI coding agents access to production or staging environments can now do so with a concrete guardrail around secret handling.
- Complements existing AWS security controls: The skill is designed to work alongside IAM least-privilege policies, CloudTrail monitoring, and VPC endpoint policies rather than replace them, fitting naturally into existing security postures.
How It's Different
- Context-window isolation vs. plain retrieval: Unlike the default behavior where agents call
get-secret-valueand receive plaintext in the context window, this skill ensures the model only ever sees a symbolic reference, never the resolved value. - Automatic enforcement, not just guidance: Many security best-practice plugins offer advisory guidance; this skill combines behavioral steering with a hard structural block (the
PreToolUsehook) that prevents direct secret retrieval regardless of how the model is prompted. - Child-process isolation: Secret resolution happens in a separate child process at execution time, a pattern borrowed from secure CI/CD pipelines, rather than within the agent process where values could be logged or cached.
- Multi-agent-harness support out of the box: The skill works across Claude Code, Codex, Cursor, and Kiro through a single plugin installation, unlike custom per-agent solutions developers would otherwise need to build and maintain.
- Open-source and AWS-supported: The Agent Toolkit for AWS is an official, AWS-maintained open-source repository, giving teams auditability and community contribution options that a closed proprietary solution would not provide.
When to Prefer It
- When AI coding agents have shell or AWS API access in any environment: Any workflow where an agent can execute CLI commands or make SDK calls should use this skill to prevent inadvertent secret retrieval.
- When working with production or staging secrets: Environments where secrets have real operational impact (database credentials, API keys, OAuth tokens) benefit most from ensuring those values never enter model context.
- When session logs or conversation histories are retained: If agent sessions are logged for debugging, auditing, or compliance purposes, this skill prevents secrets from appearing in those records.
- When building multi-step agentic pipelines: Longer agentic workflows with many tool calls increase the surface area for accidental secret exposure; the skill's runtime resolution pattern keeps secrets scoped to the exact moment they are needed.
- When onboarding developers who are new to secure secret handling: The skill's intent-clarification prompts educate developers on the correct pattern (dynamic references) rather than silently failing or allowing unsafe behavior.
- When compliance or security policy requires secrets to be kept out of AI model inputs: Organizations subject to SOC 2, PCI-DSS, or internal data classification policies can use this skill as a documented, auditable control.
Availability
- GA status: Generally available as of June 17, 2026; no preview or beta designation indicated.
- Supported agent harnesses: Claude Code, OpenAI Codex, Cursor, and Kiro (all agent harnesses supported by the Agent Toolkit for AWS).
- Regional availability: Available in all AWS Regions where AWS Secrets Manager is available.
- Pricing: The skill itself is part of the open-source Agent Toolkit for AWS at no additional charge; standard AWS Secrets Manager pricing applies for secret retrieval API calls made at execution time.
- Key prerequisite: Requires the
aws-coreplugin from the Agent Toolkit for AWS to be installed; the skill and enforcement hook activate automatically upon installation. - Important limitation: Documented as a best-effort defense, not a security boundary—it mitigates the most common leakage path but cannot prevent all evasion vectors, and must be combined with IAM least-privilege, CloudTrail monitoring, and VPC endpoint policies for comprehensive protection.
