Security Test - Next.js Secret Manager API

A Next.js application with an API endpoint to retrieve secrets from AWS Secrets Manager.

Setup

1. Install dependencies:

npm install

2. Configure AWS:

   • The application uses AWS default credential chain (IAM roles, instance profiles, etc.)
   • No access keys required when running on AWS infrastructure with proper IAM roles
   • Optional environment variable:
     • AWS_REGION - AWS region (e.g., ap-south-1). Can also be passed as query parameter.

3. (Optional) Create a .env.local file:

AWS_REGION=ap-south-1

Note: When running on AWS (EC2, ECS, Lambda), the application will automatically use IAM roles. No credentials needed!

Usage

Start the development server:

npm run dev

API Endpoint

GET/POST /api/secrets?name=<secret-name>&region=<region>&versionStage=<stage>

Retrieves a secret from AWS Secrets Manager using IAM roles (no access keys required).

Query Parameters:

• name (required): The name of the secret to retrieve
• region (optional): AWS region (e.g., ap-south-1). Defaults to AWS_REGION env var or ap-south-1
• versionStage (optional): Version stage like AWSCURRENT, AWSPREVIOUS. Defaults to AWSCURRENT

Example:

curl "http://localhost:3000/api/secrets?name=my-secret-name&region=ap-south-1&versionStage=AWSCURRENT"

Response:

{
  "success": true,
  "secret": {
    "name": "my-secret-name",
    "value": "secret-value",
    "region": "ap-south-1",
    "versionStage": "AWSCURRENT"
  }
}

Error Response:

{
  "success": false,
  "error": "Error message"
}

Security Notes

• No access keys required - Uses AWS default credential chain (IAM roles, instance profiles)
• Never commit .env.local or any files containing credentials
• Use IAM roles with least privilege access (secretsmanager:GetSecretValue permission)
• Consider adding authentication/authorization to the API endpoint in production
• Use environment-specific secret names
• When running on AWS infrastructure (EC2, ECS, Lambda), ensure the IAM role has proper Secrets Manager permissions