diff --git a/aws_cdk/lib/aws_cdk-stack.ts b/aws_cdk/lib/aws_cdk-stack.ts
index fe890cf..46d9c8a 100644
--- a/aws_cdk/lib/aws_cdk-stack.ts
+++ b/aws_cdk/lib/aws_cdk-stack.ts
@@ -3,6 +3,7 @@ import { Construct } from 'constructs';
 import * as ec2 from 'aws-cdk-lib/aws-ec2';
 import * as iam from 'aws-cdk-lib/aws-iam';
 import * as dlm from 'aws-cdk-lib/aws-dlm';
+import * as secretsmanager from 'aws-cdk-lib/aws-secretsmanager';
 
 export class AwsCdkStack extends cdk.Stack {
   constructor(scope: Construct, id: string, props?: cdk.StackProps) {
@@ -61,6 +62,18 @@ export class AwsCdkStack extends cdk.Stack {
     }
 
 
+    // 3a. Create DB Credentials Secret in AWS Secrets Manager
+    const dbSecret = new secretsmanager.Secret(this, 'SellerCentralDbSecret', {
+      secretName: 'seller-central/db-credentials',
+      description: 'Database credentials for the Seller Central application',
+      secretObjectValue: {
+        username: cdk.SecretValue.unsafePlainText('REPLACE_WITH_DB_USERNAME'),
+        host:     cdk.SecretValue.unsafePlainText('REPLACE_WITH_DB_HOST'),
+        password: cdk.SecretValue.unsafePlainText('REPLACE_WITH_DB_PASSWORD'),
+        dbname:   cdk.SecretValue.unsafePlainText('REPLACE_WITH_DB_NAME'),
+      },
+    });
+
     // Create IAM Role for EC2 Instance (to allow CloudWatch Agent to write logs & metrics)
     const role = new iam.Role(this, 'internalsRole', {
       assumedBy: new iam.ServicePrincipal('ec2.amazonaws.com'),
@@ -71,6 +84,9 @@ export class AwsCdkStack extends cdk.Stack {
     role.addManagedPolicy(iam.ManagedPolicy.fromAwsManagedPolicyName('AmazonSSMManagedInstanceCore'));
     role.addManagedPolicy(iam.ManagedPolicy.fromAwsManagedPolicyName('AmazonEC2ContainerRegistryPowerUser'));
 
+    // Grant EC2 role permission to read the DB secret
+    dbSecret.grantRead(role);
+
     // S3 access for Forgejo storage
     role.addToPolicy(new iam.PolicyStatement({
       actions: [
@@ -257,6 +273,11 @@ export class AwsCdkStack extends cdk.Stack {
       value: '16.113.57.127',
       description: 'The Elastic IP address of your Mail Server',
     });
+
+    new cdk.CfnOutput(this, 'DbSecretArn', {
+      value: dbSecret.secretArn,
+      description: 'ARN of the DB credentials secret in Secrets Manager',
+    });
   }
 }