For the trading journal, when we want to auto-import user trading data, we will need to utilize the exchange APIs. These data are super private and should be kept very secure. Prevent other people from inspecting your portfolio or even stealing your assets with API keys.

To address this issue, we can't simply use a managed database or environment variables. We need a proper secret management system that can securely store and retrieve API credentials for each user.

AWS Secrets Manager Implementation

We'll use AWS Secrets Manager with Terraform to create a secure, scalable secret management system for our trading journal application.

Terraform File Structure & Explanations

1. versions.tf - Version Control & Dependencies

Purpose: Define Terraform binary version requirements and external provider dependencies.

terraform {
  required_version = ">= 1.6.0"
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.50"
    }
  }
}

What this does:

• required_version = ">= 1.6.0" ensures anyone running this code has Terraform 1.6.0 or newer
• required_providers tells Terraform to download the AWS provider plugin
• version = "~> 5.50" means allow 5.50.x, 5.51.x, 5.99.x but NOT 6.0.0+ (prevents breaking changes)
• When you run terraform init, it downloads the exact AWS provider version and locks it in .terraform.lock.hcl

Why it matters: Prevents version conflicts between team members and protects against breaking changes in newer provider versions.

2. providers.tf - AWS Configuration & Tagging

Purpose: Configure the AWS provider with region, credentials, and default tags.

provider "aws" {
  region  = [var.aws](<http://var.aws>)_region
  profile = [var.aws](<http://var.aws>)_profile
  default_tags {
    tags = {
      Project = var.project
      Env     = var.env
    }
  }
}

What this does:

• region = [var.aws](<http://var.aws>)_region sets which AWS region to deploy resources (e.g., us-east-1, ap-northeast-1)