Secrets and Sensitive Data Management Questions

import time
import threading
import random
import boto3
from botocore.exceptions import ClientError

_secrets_cache = {}  # secret_name -> (plaintext, expiry_epoch)
_cache_lock = threading.Lock()
secrets_client = boto3.client("secretsmanager")  # pseudo-code / assume configured

def get_secret_plaintext(secret_name: str, ttl: int = 300, max_retries: int = 5) -> str:
    # Check cache
    now = time.time()
    with _cache_lock:
        entry = _secrets_cache.get(secret_name)
        if entry and entry[1] > now:
            return entry[0]

    # Retry with exponential backoff for throttling
    backoff_base = 0.5
    for attempt in range(1, max_retries + 1):
        try:
            resp = secrets_client.get_secret_value(SecretId=secret_name)
            # Secrets Manager returns SecretString or SecretBinary
            secret = resp.get("SecretString")
            if secret is None:
                secret = resp.get("SecretBinary").decode("utf-8")
            # Update cache
            expiry = time.time() + ttl
            with _cache_lock:
                _secrets_cache[secret_name] = (secret, expiry)
            return secret

        except ClientError as e:
            code = e.response.get("Error", {}).get("Code", "")
            # Handle throttling specifically
            if code in ("ThrottlingException", "TooManyRequestsException") or getattr(e, "response", {}).get("ResponseMetadata", {}).get("HTTPStatusCode") == 429:
                if attempt == max_retries:
                    raise
                # jittered exponential backoff
                sleep = backoff_base * (2 ** (attempt - 1)) + random.uniform(0, 0.1)
                time.sleep(sleep)
                continue
            # Non-retryable errors: access/permission/resource-not-found
            raise

        except Exception:
            # Catch other unexpected errors; don't cache failures
            raise