> For the complete documentation index, see [llms.txt](https://docs.p0.dev/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.p0.dev/integrations/resource-integrations/aws-secrets-manager.md).

# AWS Secrets Manager

Store credentials that other P0 integrations need, such as the GitHub App integration's private key, in your own AWS Secrets Manager account.

{% hint style="info" %}
AWS Secrets Manager is a **preview** integration.
{% endhint %}

The AWS Secrets Manager integration is a prerequisite for other P0 integrations that need to vault a credential, such as the GitHub App integration's private key. P0 stores the credential as a secret in your [AWS Secrets Manager](https://docs.aws.amazon.com/secretsmanager/latest/userguide/intro.html) account instead of holding it directly.

{% hint style="warning" %}
AWS Secrets Manager is not a requestable resource. There is no just-in-time access request flow for it in the P0 app or CLI; it exists only to back the credential storage of other integrations.
{% endhint %}

## How it works

AWS Secrets Manager builds on your existing AWS IAM management install:

* When you install a dependent integration (such as GitHub App), P0 writes that integration's credential to a secret in your AWS Secrets Manager account, using your existing AWS IAM management permissions.
* The dependent integration reads the credential from that secret as needed.
* P0 does not expose these secrets to end users through a request workflow.

## Before you begin

To set up AWS Secrets Manager, you need:

* A P0 [AWS](/integrations/resource-integrations/aws.md) integration with **IAM management** installed on the account that holds the secrets. AWS Secrets Manager reuses that integration's IAM-write access, so install it first.
* A P0 account with administrator access.

## Setting up AWS Secrets Manager

1. Navigate to **Integrations** on [p0.app](https://p0.app) and select the **AWS Secrets Manager** integration.
2. Select the **Vault** component.

   <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p><strong>Vault</strong> is your AWS Secrets Manager. P0 does not copy or store your credentials.</p></div>
3. Select the AWS account where your IAM management integration is installed.
4. Choose the **Default region** where P0 creates new secrets.
5. Click **Finish**.

{% hint style="success" %}
P0 can now vault credentials for dependent integrations in your AWS Secrets Manager account.
{% endhint %}

## Additional resources

* [AWS](/integrations/resource-integrations/aws.md)
* [AWS Secrets Manager access control documentation](https://docs.aws.amazon.com/secretsmanager/latest/userguide/auth-and-access.html)