SecureRequest.AwsSecretsManager 1.0.0

SecureRequest.AwsSecretsManager

AWS Secrets Manager provider for the SecureRequest NuGet package.

Stores the RSA private key inside AWS Secrets Manager instead of Redis/IDistributedCache, protected by IAM access control, CloudTrail audit logging, and KMS encryption at rest.

Installation

dotnet add package SecureRequest
dotnet add package SecureRequest.AwsSecretsManager

Usage

Chain .WithAwsSecretsManager() onto AddSecureRequest():

builder.Services
 .AddSecureRequest(builder.Configuration)
 .WithAwsSecretsManager(); // uses default AWS credential chain (IAM role, env vars, ~/.aws)

The AWS SDK default credential chain is used automatically — picks up IAM roles (EC2/ECS/Lambda/EKS), environment variables (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY), and ~/.aws/credentials in development.

Custom secret ID and region

builder.Services
 .AddSecureRequest(builder.Configuration)
 .WithAwsSecretsManager(
 secretId : "myapp/prod/rsa-key",
 region : RegionEndpoint.EUWest1);

Bring your own client (already in DI)

// Register with custom credentials
builder.Services.AddSingleton<IAmazonSecretsManager>(
 new AmazonSecretsManagerClient(new StoredProfileAWSCredentials("my-profile")));

builder.Services
 .AddSecureRequest(builder.Configuration)
 .WithAwsSecretsManager(
 clientFactory: sp => sp.GetRequiredService<IAmazonSecretsManager>());

Required IAM permissions

The IAM role or user running the application needs the following policy:

{
 "Effect": "Allow",
 "Action": [
 "secretsmanager:GetSecretValue",
 "secretsmanager:CreateSecret",
 "secretsmanager:PutSecretValue"
 ],
 "Resource": "arn:aws:secretsmanager:REGION:ACCOUNT:secret:secure-request/rsa-private-key*"
}

On first startup the provider creates the secret (CreateSecret). On every subsequent startup it reads it back (GetSecretValue). On key rotation it updates the value (PutSecretValue).

appsettings.json

No changes needed — SecureRequest options are still bound from the same section:

"SecureRequest": {
 "Enabled": true,
 "EnableBodyEncryption": true,
 "EnableHmacSigning": true,
 "TimestampToleranceSeconds": 300,
 "NonceCacheTtlSeconds": 700,
 "SecuredMethods": ["POST", "PUT", "PATCH"],
 "ExcludedPaths": []
}

Note: IDistributedCache is still required for nonce anti-replay storage. Only the RSA private key moves to Secrets Manager — nonces remain in Redis/in-memory cache.

Comparison

License

MIT