AWS Secrets Manager × Sentiqra

Manage Sentiqra API credentials through your existing AWS secrets workflow.

Why This Integration Matters

Every enterprise security team requires programmatic secret rotation. If you don't document how Sentiqra API keys integrate with industry-standard secret managers, security engineers assume you don't support it and route to a competitor who does.

AWS Secrets Manager is the native AWS solution for secret rotation. By storing Sentiqra API keys in Secrets Manager, your application fetches credentials at request time with automatic rotation via Lambda rotation functions - zero human touch on production secrets.

This addresses the "how do we rotate API keys without downtime?" procurement question for AWS-native deployments. Secrets Manager integrates natively with IAM, CloudFormation, and ECS/Kubernetes service accounts.

Reference Architecture

┌──────────────────────────────────────────────────────────────┐
│                   AWS Infrastructure                         │
│                                                               │
│  ┌──────────┐    ┌───────────────┐    ┌──────────┐           │
│  │  App      │───▶│ AWS Secrets   │───▶│ Returns  │           │
│  │  (ECS /   │    │ Manager       │    │ API Key  │           │
│  │   Lambda /│    │               │    │          │           │
│  │   EC2)    │    │ Rotation      │    │          │           │
│  │           │    │ Lambda →      │    │          │           │
│  │           │    │ Sentiqra API  │    │          │           │
│  │           │◀───│ key rotated   │◀───│          │           │
│  └─────┬─────┘    │ every 30 days │    └──────────┘           │
│        │          └───────────────┘                           │
│        │  API Key from Secrets Manager                        │
│        ▼                                                      │
│  ┌──────────┐                                                │
│  │ Sentiqra │                                                │
│  │  API     │                                                │
│  └──────────┘                                                │
└──────────────────────────────────────────────────────────────┘

Data flow: Your application calls secretsmanager:GetSecretValue → AWS returns the Sentiqra API key → your application calls Sentiqra → a Lambda rotation function rotates the key every 30 days automatically. IAM policies restrict which services can read the secret.

Working Code

Actual, tested, copy-pasteable code. Not pseudocode. Not aspirational.

import boto3
import json
import requests

# 1. Fetch API key from AWS Secrets Manager
def get_api_key() -> str:
    client = boto3.client("secretsmanager", region_name="us-east-1")
    response = client.get_secret_value(SecretId="sentiqra/prod/api-key")
    return json.loads(response["SecretString"])["api_key"]

# 2. Use Sentiqra with AWS-managed key
response = requests.post(
    "https://sentiqra.tech/v1/analyze",
    headers={
        "Authorization": f"Bearer {get_api_key()}",
        "Content-Type": "application/json",
    },
    json={"text": "you are a worthless idiot", "language": "en", "analyzers": ["trust-safety"]},
    timeout=10,
)
data = response.json()
top = data["signals"][0]
print(top["code"])    # 'insults_derogation'
print(top["score"])   # 0.99

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "secretsmanager:GetSecretValue",
      "Resource": "arn:aws:secretsmanager:us-east-1:123456789012:secret:sentiqra/prod/api-key-*"
    }
  ]
}

aws secretsmanager create-secret \
  --name sentiqra/prod/api-key \
  --secret-string '{"api_key":"sq_live_your_api_key_here"}'

# Enable automatic rotation (requires Lambda rotation function):
aws secretsmanager rotate-secret \
  --secret-id sentiqra/prod/api-key \
  --rotation-lambda-arn arn:aws:lambda:us-east-1:123456789012:function:sentiqra-key-rotation \
  --rotation-rules AutomaticallyAfterDays=30

Security & Compliance Posture

• ✓
  SOC 2 Type II - CC6.1 - Logical Access: API keys are stored in Secrets Manager with IAM-based access control. No human access to production secrets.
• ✓
  Automatic Key Rotation: Lambda rotation functions can rotate keys every 30 days with zero downtime, addressing common procurement requirements for programmatic secret rotation.
• ✓
  AWS Native Integration: Works with IAM, CloudFormation, ECS task roles, and Lambda execution roles - no additional infrastructure required for AWS-native deployments.
• ✓
  CloudTrail Audit: Every secret access is logged in CloudTrail, providing a complete audit trail of API key usage.
• ✓
  Encryption at Rest: Secrets are encrypted with KMS, with optional customer-managed CMK for additional control.

Deployment Notes