End-to-End Guide: Go App + AWS Secrets Manager + RDS (With Automatic Rotation Handling)

sudo yum update -y   # (Amazon Linux)
sudo yum install -y golang
go version

// main.go
package main
 
import (
	"context"
	"database/sql"
	"encoding/json"
	"fmt"
	"log"
	"net/http"
	"sync"
	"time"
 
	_ "github.com/go-sql-driver/mysql"
	"github.com/aws/aws-sdk-go-v2/config"
	"github.com/aws/aws-sdk-go-v2/service/secretsmanager"
)
 
type DBSecret struct {
	Username string `json:"username"`
	Password string `json:"password"`
	Host     string `json:"host"`
	DBName   string `json:"dbname"`
}
 
type SecretCache struct {
	secret    DBSecret
	expiresAt time.Time
	mu        sync.RWMutex
}
 
type App struct {
	client     *secretsmanager.Client
	secretName string
	cache      *SecretCache
}
 
func NewApp(ctx context.Context, secretName string) *App {
	cfg, err := config.LoadDefaultConfig(ctx, config.WithRegion("ap-south-1")) // change region
	if err != nil {
		log.Fatalf("❌ Unable to load AWS SDK config: %v", err)
	}
 
	return &App{
		client:     secretsmanager.NewFromConfig(cfg),
		secretName: secretName,
		cache:      &SecretCache{},
	}
}
 
// fetchSecretFromAWS pulls fresh secret from Secrets Manager
func (a *App) fetchSecretFromAWS(ctx context.Context) (DBSecret, error) {
	secretValue, err := a.client.GetSecretValue(ctx, &secretsmanager.GetSecretValueInput{
		SecretId: &a.secretName,
	})
	if err != nil {
		return DBSecret{}, err
	}
 
	var secret DBSecret
	if err := json.Unmarshal([]byte(*secretValue.SecretString), &secret); err != nil {
		return DBSecret{}, err
	}
 
	log.Println("🔑 [AWS] Fetched new credentials from Secrets Manager")
	return secret, nil
}
 
// getCachedSecret returns cached secret or fetches new if expired
func (a *App) getCachedSecret(ctx context.Context) (DBSecret, error) {
	a.cache.mu.RLock()
	if time.Now().Before(a.cache.expiresAt) {
		secret := a.cache.secret
		a.cache.mu.RUnlock()
		log.Println("📦 [Cache] Using cached credentials")
		return secret, nil
	}
	a.cache.mu.RUnlock()
 
	secret, err := a.fetchSecretFromAWS(ctx)
	if err != nil {
		return DBSecret{}, err
	}
 
	a.cache.mu.Lock()
	a.cache.secret = secret
	a.cache.expiresAt = time.Now().Add(5 * time.Minute)
	a.cache.mu.Unlock()
 
	return secret, nil
}
 
// connectDB tries DB connection and retries with fresh creds if needed
func (a *App) connectDB(ctx context.Context) (*sql.DB, DBSecret, error) {
	secret, err := a.getCachedSecret(ctx)
	if err != nil {
		return nil, DBSecret{}, err
	}
 
	dsn := fmt.Sprintf("%s:%s@tcp(%s)/%s", secret.Username, secret.Password, secret.Host, secret.DBName)
	db, err := sql.Open("mysql", dsn)
	if err != nil {
		return nil, secret, err
	}
 
	if err := db.Ping(); err != nil {
		log.Println("❌ DB connection failed. Retrying with fresh creds...")
 
		secret, err = a.fetchSecretFromAWS(ctx)
		if err != nil {
			return nil, DBSecret{}, err
		}
 
		a.cache.mu.Lock()
		a.cache.secret = secret
		a.cache.expiresAt = time.Now().Add(5 * time.Minute)
		a.cache.mu.Unlock()
 
		dsn := fmt.Sprintf("%s:%s@tcp(%s)/%s", secret.Username, secret.Password, secret.Host, secret.DBName)
		db, err = sql.Open("mysql", dsn)
		if err != nil {
			return nil, DBSecret{}, err
		}
		if err := db.Ping(); err != nil {
			return nil, DBSecret{}, err
		}
 
		log.Println("✅ DB reconnected with fresh creds")
		return db, secret, nil
	}
 
	log.Println("✅ DB connected successfully with cached creds")
	return db, secret, nil
}
 
func (a *App) secretHandler(w http.ResponseWriter, r *http.Request) {
	ctx := r.Context()
	db, secret, err := a.connectDB(ctx)
	if err != nil {
		http.Error(w, fmt.Sprintf("DB connection error: %v", err), http.StatusInternalServerError)
		return
	}
	defer db.Close()
 
	var now string
	if err := db.QueryRow("SELECT NOW()").Scan(&now); err != nil {
		http.Error(w, fmt.Sprintf("DB query error: %v", err), http.StatusInternalServerError)
		return
	}
 
	log.Printf("⏱️ DB Time: %s", now)
 
	resp := map[string]string{
		"db_time": now,
		"user":    secret.Username,
		"host":    secret.Host,
	}
	w.Header().Set("Content-Type", "application/json")
	json.NewEncoder(w).Encode(resp)
}
 
func main() {
	ctx := context.Background()
	app := NewApp(ctx, "mydb-secret") // Replace with your actual secret name
 
	// Initial warm-up
	_, err := app.fetchSecretFromAWS(ctx)
	if err != nil {
		log.Fatalf("❌ Failed to fetch initial secret: %v", err)
	}
 
	http.HandleFunc("/secret", app.secretHandler)
	log.Println("🚀 Server started at http://localhost:8080")
	log.Fatal(http.ListenAndServe(":8080", nil))
}

go mod init myapp
go get github.com/aws/aws-sdk-go-v2/config
go get github.com/aws/aws-sdk-go-v2/service/secretsmanager
go get github.com/go-sql-driver/mysql
go build -o app main.go
export AWS_REGION=ap-south-1   # match your region
./app

🔑 [AWS] Fetched new credentials from Secrets Manager
🚀 Server started at http://localhost:8080

curl http://<EC2_PUBLIC_IP>:8080/secret

{
  "db_time": "2025-09-01 12:34:56",
  "user": "admin",
  "host": "mydb.abc123.ap-south-1.rds.amazonaws.com"
}

while true; do
  curl -s http://13.126.172.85:8080/secret
  sleep 1
done

watch -n 1 curl -s http://13.126.172.85:8080/secret

❌ DB connection failed. Retrying with fresh creds...
🔑 [AWS] Fetched new credentials from Secrets Manager
✅ DB reconnected with fresh creds

sudo nano /etc/systemd/system/goapp.service

[Unit]
Description=Go Secrets Manager Demo
After=network.target
 
[Service]
ExecStart=/home/ec2-user/app
Restart=always
User=ec2-user
WorkingDirectory=/home/ec2-user
 
[Install]
WantedBy=multi-user.target

sudo systemctl daemon-reload
sudo systemctl enable goapp
sudo systemctl start goapp
journalctl -u goapp -f