Skip to main content

The CDK Construct Library for AWS::SecretsManager

Project description

AWS SecretsManager Construct Library

const secretsmanager = require('@aws-cdk/aws-secretsmanager');

Create a new Secret in a Stack

In order to have SecretsManager generate a new secret value automatically, you can get started with the following:

    // Default secret
    const secret = new secretsManager.Secret(this, 'Secret');

    new iam.User(this, 'User', {
      password: secret.secretValue

    // Templated secret
    const templatedSecret = new secretsManager.Secret(this, 'TemplatedSecret', {
      generateSecretString: {
        secretStringTemplate: JSON.stringify({ username: 'user' }),
        generateStringKey: 'password'

    new iam.User(this, 'OtherUser', {
      userName: templatedSecret.secretJsonValue('username').toString(),
      password: templatedSecret.secretJsonValue('password')

The Secret construct does not allow specifying the SecretString property of the AWS::SecretsManager::Secret resource (as this will almost always lead to the secret being surfaced in plain text and possibly committed to your source control).

If you need to use a pre-existing secret, the recommended way is to manually provision the secret in AWS SecretsManager and use the Secret.import method to make it available in your CDK Application:

const secret = Secret.import(scope, 'ImportedSecret', {
  secretArn: 'arn:aws:secretsmanager:<region>:<account-id-number>:secret:<secret-name>-<random-6-characters>',
  // If the secret is encrypted using a KMS-hosted CMK, either import or reference that key:

SecretsManager secret values can only be used in select set of properties. For the list of properties, see the CloudFormation Dynamic References documentation.

Rotating a Secret

A rotation schedule can be added to a Secret:

const fn = new lambda.Function(...);
const secret = new secretsManager.Secret(this, 'Secret');

secret.addRotationSchedule('RotationSchedule', {
  rotationLambda: fn,
  automaticallyAfterDays: 15

See Overview of the Lambda Rotation Function on how to implement a Lambda Rotation Function.

For RDS credentials rotation, see aws-rds.

Project details

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Filename, size & hash SHA256 hash help File type Python version Upload date
aws_cdk.aws_secretsmanager-0.28.0-py3-none-any.whl (59.8 kB) Copy SHA256 hash SHA256 Wheel py3 (61.5 kB) Copy SHA256 hash SHA256 Source None

Supported by

Elastic Elastic Search Pingdom Pingdom Monitoring Google Google BigQuery Sentry Sentry Error logging AWS AWS Cloud computing DataDog DataDog Monitoring Fastly Fastly CDN SignalFx SignalFx Supporter DigiCert DigiCert EV certificate StatusPage StatusPage Status page