---
title: "Create the secret's place in code and its · Agent Wranglers"
url: https://agentwranglers.se/playbook/infrastructure/configuration-and-secrets/secret-containers-in-code
updated: 2026-10-20
licence: "All rights reserved"
---

# Create the secret's place in code and its value in the store

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Required
- Chapter: [Configuration and secrets](https://agentwranglers.se/playbook/infrastructure/configuration-and-secrets)
- Rule: Create each secret's entry, owner and access policy in code. Put its value in the store by rotation or by hand, never through a code variable.
- How: Declare the secret in the infrastructure code, with its name, its encryption key and the one role that may read it. Leave the value out. The store generates it, or the database service manages it, as RDS does with `manage_master_user_password`. Plain settings, such as a region or a feature limit, go in the variables file or a parameter store.
- Check: The grep below finds no `secret_string`, password or key argument set to a quoted literal. Every secret in the store has an owner tag and exactly one reading role.

Example:

```hcl
resource "aws_secretsmanager_secret" "payment_api_key" {
  name       = "production/shop/payment-api-key"
  kms_key_id = aws_kms_key.secrets.arn
  tags       = { owner = "payments-team" }
}

resource "aws_db_instance" "orders" {
  identifier                  = "shop-orders"
  username                    = "shop_admin"
  manage_master_user_password = true   # the database service creates and rotates it
}
```

```sh
# Fails when a secret argument holds a literal value
! grep -rnE '(secret_string|password|private_key|secret_key|access_key|api_key) *= *"[^"]+"' infra --include=*.tf
```

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers infrastructure playbook: https://agentwranglers.se/playbook/infrastructure/configuration-and-secrets/secret-containers-in-code`.

- Next: [Keep secrets out of state](https://agentwranglers.se/playbook/infrastructure/configuration-and-secrets/secrets-out-of-state)
- [Configuration and secrets](https://agentwranglers.se/playbook/infrastructure/configuration-and-secrets)