# AWS Secrets Manager Hooks

**URL:** https://forum.buildkite.community/t/aws-secrets-manager-hooks/175
**Category:** Elastic CI Stack for AWS
**Created:** [December 17, 2018, 5:55am UTC](https://forum.buildkite.community/t/aws-secrets-manager-hooks/175 "2018-12-17T05:55:17Z")
**Posts on this page:** 1
**Page:** 1

<div class="post-metadata">

### Author: ![anon18197598](https://avatars.discourse-cdn.com/v4/letter/a/9d8465/32.png) [@anon18197598](https://forum.buildkite.community/u/anon18197598)
#### Post date: [December 17, 2018, 5:55am UTC](https://forum.buildkite.community/t/aws-secrets-manager-hooks/175/1 "2018-12-17T05:55:17Z")

</div>

A little while back we wrote some experimental hooks to make use of Amazon’s Secrets Manager:

> **[buildkite/elastic-ci-stack-ssm-secrets-hooks](https://github.com/buildkite/elastic-ci-stack-ssm-secrets-hooks)**
>
> 🕵️‍♀️ Agent hooks for fetching git credentials from Amazon SSM Parameter Store - buildkite/elastic-ci-stack-ssm-secrets-hooks

The thinking is that these would eventually replace the [s3 secrets hooks](https://github.com/buildkite/elastic-ci-stack-s3-secrets-hooks) that are currently part of the Elastic Stack.

The scope of the Secrets Manager hooks are much more limited. They are for credentials for the repository checkout, after which you’d use one of the other more configuration oriented secrets options like [https://github.com/seek-oss/aws-sm-buildkite-plugin](https://github.com/seek-oss/aws-sm-buildkite-plugin).

Another design concern that featured strongly was using a queue prefix in the secrets manager ARN’s, which allows access to secrets by queue to be easily established by prefix.

Keen to hear everyones thoughts on this approach!