AWS Secrets Manager

A place to store n8n, lemlist, Claude, and and Google Sheets Keys

Stop hardcoding API keys in your n8n workflows! This comprehensive guide shows you how to securely store and retrieve API keys using AWS Secrets Manager – for just $1.60/month.

Why Use AWS Secrets Manager?

Before this setup:

  • API keys hardcoded in n8n workflows
  • Security risks if workflows are shared
  • Manual key rotation
  • No centralized key management

After this setup:

  • All API keys stored securely in AWS
  • Automatic encryption at rest
  • Centralized management
  • Easy rotation and access control
  • Costs only $0.40 per secret per month

Overview: What We’ll Build

Claude API Key (Anthropic) → AWS Secrets Manager → n8n Workflows
Lemlist API Key → AWS Secrets Manager → n8n Workflows  
Google Sheets Credentials → AWS Secrets Manager → n8n Workflows

Total estimated cost: $1.60/month for 4 API secrets

Part 1: Secure Your AWS Root Account

Step 1: Enable MFA on Root Account

Critical first step – never skip this!

  1. Sign into AWS Console with your root account (email/password)
  2. Go to Security Credentials:
    • Click your account name (top right) → “Security credentials”
  3. Find “Multi-factor authentication (MFA)” section
  4. Click “Assign MFA device”
  5. Choose “Virtual MFA device”
  6. Install Microsoft Authenticator on your phone
  7. Scan the QR code in Microsoft Authenticator
  8. Enter two consecutive codes:
    • Enter first 6-digit code
    • Wait 30 seconds for new code
    • Enter second 6-digit code
  9. Click “Assign MFA”

Test it: Sign out and back in – you should now need email + password + MFA code.

Part 2: Create Your Admin User

Stop using the root account for daily tasks!

Step 2: Create Personal Admin User

  1. Go to IAM → Users → Create user
  2. User details:
    • Username: n8n-admin (or your preferred name)
    • ✅ Check “Provide user access to AWS Management Console”
    • ✅ Check “I want to create an IAM user”
  3. Set password:
    • Select “Custom password”
    • Enter strong password (save in password manager!)
    • ❌ Uncheck “Users must create new password at next sign-in”
  4. Click “Next”
  5. Permissions:
    • Select “Attach policies directly”
    • Search for “AdministratorAccess”
    • ✅ Check “AdministratorAccess”
  6. Skip tags
  7. Click “Create user”

Save your credentials:

  • Username: n8n-admin
  • Console sign-in URL: (AWS provides this)
  • Password: (the one you set)

Step 3: Test and Secure Admin User

  1. Sign out of root account
  2. Sign in with n8n-admin using the console URL
  3. Add MFA to admin user:
    • Go to IAM → Users → n8n-admin
    • Click “Security credentials” tab
    • Under MFA section → “Assign MFA device”
    • Choose “Virtual MFA device”
    • Name: n8n-admin - iPhone
    • Scan QR code with Microsoft Authenticator
    • Enter two consecutive codes

Test it: Sign out and back in with n8n-admin – should require MFA.

Part 3: Create Service Account for n8n

Step 4: Create n8n Service User

This user will have limited permissions – only read secrets.

  1. While logged in as n8n-admin:
  2. Go to IAM → Users → Create user
  3. User details:
    • Username: n8n-secrets-user
    • ❌ DO NOT check console access (programmatic only)
  4. Click “Next”
  5. Permissions:
    • Select “Attach policies directly”
    • Click “Create policy” (opens new tab)

Step 5: Create Custom Security Policy

In the new policy tab:

  1. Click “JSON” tab
  2. Replace all content with this policy:
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "GetN8NSecrets",
            "Effect": "Allow",
            "Action": [
                "secretsmanager:GetSecretValue",
                "secretsmanager:DescribeSecret"
            ],
            "Resource": [
                "arn:aws:secretsmanager:*:*:secret:n8n/*"
            ]
        },
        {
            "Sid": "ListSecretsForN8N",
            "Effect": "Allow",
            "Action": [
                "secretsmanager:ListSecrets"
            ],
            "Resource": "*",
            "Condition": {
                "StringLike": {
                    "secretsmanager:Name": "n8n/*"
                }
            }
        }
    ]
}
  1. Click “Next”
  2. Policy details:
    • Name: N8N-SecretsManager-Policy
    • Description: Allows n8n to read API keys from Secrets Manager
  3. Skip tags
  4. Click “Create policy”

Step 6: Attach Policy to User

  1. Return to user creation tab
  2. Refresh the page if policy doesn’t appear
  3. Search for: N8N-SecretsManager-Policy
  4. ✅ Check the policy
  5. Click “Next”
  6. Skip tags
  7. Click “Create user”

Step 7: Create Access Keys

  1. Go to IAM → Users → n8n-secrets-user
  2. Click “Security credentials” tab
  3. Scroll to “Access keys” section
  4. Click “Create access key”
  5. Choose use case: “Application running outside AWS”
  6. Add description: n8n API keys access
  7. Click “Create access key”

🚨 CRITICAL: Save these immediately – you won’t see them again!

  • Access Key ID: AKIA...
  • Secret Access Key: wJalrXUtnFEMI...

Part 4: Get Your API Keys

Step 8: Create Claude API Key

  1. Go to: https://console.anthropic.com/
  2. Click “API Keys”
  3. Click “Create Key”
  4. Name: claude-api-production
  5. Copy the full key immediately (starts with sk-ant-api03-...)

Step 9: Create Lemlist API Key

  1. Go to: https://app.lemlist.com/
  2. Sign in to your Lemlist account
  3. Go to Settings → Integrations
  4. Click “API” or “Developer”
  5. Generate new API key:
    • Name: n8n-automation
    • Copy the API key immediately
  6. Save the key – it typically starts with ll_ or similar format

Step 10: Set Up Google Sheets API Access

Create Google Cloud Project:

  1. Go to: https://console.cloud.google.com/
  2. Create new project:
    • Project name: n8n-integrations
    • Click “Create”

Enable Google Sheets API:

  1. Go to APIs & Services → Library
  2. Search for “Google Sheets API”
  3. Click “Google Sheets API” → “Enable”

Create Service Account:

  1. Go to APIs & Services → Credentials
  2. Click “Create Credentials” → “Service Account”
  3. Service account details:
    • Name: n8n-sheets-access
    • Description: Service account for n8n Google Sheets integration
  4. Click “Create and Continue”
  5. Skip role assignment (we’ll set permissions on individual sheets)
  6. Click “Done”

Generate Service Account Key:

  1. Click on your new service account
  2. Go to “Keys” tab
  3. Click “Add Key” → “Create new key”
  4. Choose “JSON” format
  5. Click “Create”
  6. Save the downloaded JSON file – it contains all credentials

Alternative: OAuth2 Setup (for user access):

If you prefer OAuth2 instead of service account:

  1. Go to APIs & Services → Credentials
  2. Click “Create Credentials” → “OAuth client ID”
  3. Choose “Desktop application”
  4. Name: n8n-oauth-client
  5. Click “Create”
  6. Save Client ID and Client Secret
  7. Generate refresh token using OAuth2 playground or similar tool

Part 5: Store Secrets in AWS

Step 11: Create Claude API Secret

  1. Go to AWS Secrets Manager: https://console.aws.amazon.com/secretsmanager/
  2. Click “Store a new secret”
  3. Choose “Other type of secret”
  4. Key/value pairs:
    • Key: api_key
    • Value: sk-ant-api03-[your-full-claude-key]
  5. Leave encryption as default
  6. Click “Next”
  7. Secret name: n8n/claude/api-key
  8. Description: Claude API key for n8n workflows
  9. Click “Next”
  10. Disable automatic rotation
  11. Click “Next”
  12. Click “Store”

Step 12: Create Lemlist API Secret

  1. In AWS Secrets Manager, click “Store a new secret”
  2. Choose “Other type of secret”
  3. Key/value pairs:
    • Key: api_key
    • Value: [your-lemlist-api-key]
  4. Click “Next”
  5. Secret name: n8n/lemlist/api-key
  6. Description: Lemlist API key for email campaign automation
  7. Click “Next”
  8. Disable automatic rotation
  9. Click “Next”
  10. Click “Store”

Step 13: Create Google Sheets Credentials Secret

For Service Account (Recommended):

  1. Click “Store a new secret”
  2. Choose “Other type of secret”
  3. Key/value pairs (from your downloaded JSON file):
    • Key: type, Value: service_account
    • Key: project_id, Value: [your-project-id]
    • Key: private_key_id, Value: [your-private-key-id]
    • Key: private_key, Value: [your-private-key] (include the full key with —–BEGIN/END—–)
    • Key: client_email, Value: [your-service-account-email]
    • Key: client_id, Value: [your-client-id]
    • Key: auth_uri, Value: https://accounts.google.com/o/oauth2/auth
    • Key: token_uri, Value: https://oauth2.googleapis.com/token
  4. Click “Next”
  5. Secret name: n8n/google-sheets/service-account
  6. Description: Google Sheets service account credentials for n8n
  7. Disable rotation → “Store”

For OAuth2 Setup:

  1. Click “Store a new secret”
  2. Choose “Other type of secret”
  3. Key/value pairs:
    • Key: client_id, Value: [your-oauth-client-id]
    • Key: client_secret, Value: [your-oauth-client-secret]
    • Key: refresh_token, Value: [your-refresh-token]
    • Key: access_token, Value: [your-access-token] (optional)
  4. Secret name: n8n/google-sheets/oauth
  5. Description: Google Sheets OAuth2 credentials for n8n

Step 14: Verify All Secrets

Go to Secrets Manager dashboard:

  • You should see 3-4 secrets with names starting with n8n/
  • Each costs $0.40/month
  • All should show “Active” status

Your secrets structure:

n8n/claude/api-key
n8n/lemlist/api-key  
n8n/google-sheets/service-account (or oauth)

Part 6: Using in n8n

Step 15: Configure n8n AWS Connection

In your n8n workflows:

  1. Add AWS Secrets Manager node
  2. Configure credentials:
    • AWS Access Key ID: AKIA... (from Step 7)
    • AWS Secret Access Key: wJalrXUtnFEMI... (from Step 7)
    • Region: us-east-2 (or your chosen region)

Step 16: Retrieve Claude API Key

AWS Secrets Manager node configuration:

  • Secret Name: n8n/claude/api-key
  • Version Stage: AWSCURRENT

Set node to extract the key:

// In a Set node after AWS Secrets Manager
const secretData = JSON.parse($node["AWS Secrets Manager"].json["SecretString"]);
return [{
  claude_api_key: secretData.api_key
}];

Step 17: Retrieve Lemlist API Key

AWS Secrets Manager node:

  • Secret Name: n8n/lemlist/api-key

Use in HTTP Request node:

// In HTTP Request node for Lemlist API
// Authorization: Bearer {{$node["Set Lemlist Key"].json["api_key"]}}

Step 18: Retrieve Google Sheets Credentials

For Service Account:

// In a Set node after retrieving Google Sheets secret
const secretData = JSON.parse($node["AWS Secrets Manager"].json["SecretString"]);
return [{
  google_service_account: {
    type: secretData.type,
    project_id: secretData.project_id,
    private_key: secretData.private_key,
    client_email: secretData.client_email,
    // ... other fields
  }
}];

Share sheet with service account:

  1. In Google Sheets, click “Share”
  2. Add the service account email (from your JSON file)
  3. Give “Editor” or “Viewer” permissions

Example n8n Workflow Structure

Multi-API Workflow:

1. AWS Secrets Manager → Get Claude API key
2. AWS Secrets Manager → Get Lemlist API key  
3. AWS Secrets Manager → Get Google Sheets credentials
4. Set Variables → Extract all keys
5. Google Sheets → Read data
6. Claude API → Process data
7. Lemlist → Send personalized emails

Security Best Practices

✅ What We Implemented

  • Root account MFA: Emergency access only
  • Admin user MFA: Your daily access
  • Service account: Limited permissions, no console access
  • Least privilege: n8n user can only read n8n/* secrets
  • Encryption: All secrets encrypted at rest
  • Audit trail: CloudTrail logs all secret access

🔄 Ongoing Maintenance

Every 90 days:

  • Rotate access keys for n8n-secrets-user
  • Review secret access logs
  • Update API keys in Secrets Manager

Monthly:

  • Check AWS bill (should be ~$1.60 for 4 secrets)
  • Review CloudTrail logs for unusual activity

Cost Breakdown

ItemMonthly Cost
Claude API secret$0.40
Lemlist API secret$0.40
Google Sheets credentials$0.40
Additional API secrets$0.40 each
Total for 4 secrets$1.60/month

Plus minimal charges for API calls (~$0.05 per 10,000 requests)

Troubleshooting Common Issues

“Policy not found during user creation”

  • Refresh the browser tab where you’re creating the user
  • Policy creation can take 30-60 seconds to propagate

“Access Denied” when retrieving secrets

  • Verify the secret name starts with n8n/
  • Check that you’re using the correct AWS region
  • Ensure access keys belong to n8n-secrets-user

“Secret not found” in n8n

  • Verify secret name exactly matches (case-sensitive)
  • Check AWS region configuration in n8n
  • Test API credentials in AWS CLI first

Lemlist API Issues

  • Verify your Lemlist plan supports API access
  • Check API rate limits in Lemlist dashboard
  • Ensure API key has correct permissions for your use case

Google Sheets Access Denied

  • For Service Account: Share the specific sheet with service account email
  • For OAuth2: Ensure refresh token hasn’t expired
  • Check that Google Sheets API is enabled in Google Cloud Console
  • Verify the service account has proper IAM roles

High unexpected charges

  • Each secret costs $0.40/month (not per access)
  • Check if you accidentally enabled Premium HSM encryption
  • Review CloudTrail logs for unexpected API usage

Alternative Approaches Considered

Why Not Environment Variables?

  • Security: Visible in process lists and logs
  • Rotation: Manual updates across all deployments
  • Sharing: Difficult to share workflows safely

Why Not n8n Credentials Store?

  • Backup: Harder to backup and restore
  • Centralization: Not accessible by other applications
  • Enterprise: Limited audit and compliance features

Next Steps

Immediate Actions

  1. Test your setup by creating a simple n8n workflow
  2. Create secrets for all your current API integrations
  3. Update existing workflows to use Secrets Manager
  4. Set calendar reminder for 90-day key rotation

Advanced Configurations

  • Set up CloudTrail for detailed audit logging
  • Create CloudWatch alarms for unusual secret access
  • Implement automated key rotation with Lambda functions
  • Use AWS IAM Identity Center for larger team setups

Conclusion

This setup provides enterprise-grade security for your n8n API keys at an incredibly low cost. You now have:

  • ✅ Secure storage for all API credentials
  • ✅ Centralized management through AWS console
  • ✅ Audit trail of all secret access
  • ✅ Easy rotation process for keys
  • ✅ Cost-effective solution at $1.60/month

The initial setup takes about 30 minutes, but you’ll save hours of security headaches and have peace of mind knowing your API keys are properly secured.

This guide was tested in August 2025 with n8n, AWS Secrets Manager, and Claude API. Costs and interfaces may change over time.

Scroll to Top