The CDK Construct Library for AWS::SecretsManager
Project description
AWS Secrets Manager Construct Library
This is a developer preview (public beta) module. Releases might lack important features and might have future breaking changes.
This API is still under active development and subject to non-backward compatible changes or removal in any future version. Use of the API is not recommended in production environments. Experimental APIs are not subject to the Semantic Versioning model.
const secretsmanager = require('@aws-cdk/aws-secretsmanager');
Create a new Secret in a Stack
In order to have SecretsManager generate a new secret value automatically, you can get started with the following:
// Default secret
const secret = new secretsManager.Secret(this, 'Secret');
secret.grantRead(role);
new iam.User(this, 'User', {
password: secret.secretValue
});
// Templated secret
const templatedSecret = new secretsManager.Secret(this, 'TemplatedSecret', {
generateSecretString: {
secretStringTemplate: JSON.stringify({ username: 'user' }),
generateStringKey: 'password'
}
});
new iam.User(this, 'OtherUser', {
userName: templatedSecret.secretValueFromJson('username').toString(),
password: templatedSecret.secretValueFromJson('password')
});
The Secret
construct does not allow specifying the SecretString
property
of the AWS::SecretsManager::Secret
resource (as this will almost always
lead to the secret being surfaced in plain text and possibly committed to
your source control).
If you need to use a pre-existing secret, the recommended way is to manually
provision the secret in AWS SecretsManager and use the Secret.import
method to make it available in your CDK Application:
const secret = Secret.import(scope, 'ImportedSecret', {
secretArn: 'arn:aws:secretsmanager:<region>:<account-id-number>:secret:<secret-name>-<random-6-characters>',
// If the secret is encrypted using a KMS-hosted CMK, either import or reference that key:
encryptionKey,
});
SecretsManager secret values can only be used in select set of properties. For the list of properties, see the CloudFormation Dynamic References documentation.
Rotating a Secret
A rotation schedule can be added to a Secret:
const fn = new lambda.Function(...);
const secret = new secretsManager.Secret(this, 'Secret');
secret.addRotationSchedule('RotationSchedule', {
rotationLambda: fn,
automaticallyAfterDays: 15
});
See Overview of the Lambda Rotation Function on how to implement a Lambda Rotation Function.
For RDS credentials rotation, see aws-rds.
Project details
Release history Release notifications | RSS feed
Download files
Download the file for your platform. If you're not sure which to choose, learn more about installing packages.
Source Distribution
Built Distribution
Hashes for aws-cdk.aws-secretsmanager-0.36.1.tar.gz
Algorithm | Hash digest | |
---|---|---|
SHA256 | 47a3606fc4b312a39120dfaf167f69b7fdcc7b299c3d72dc58757831ea2449e8 |
|
MD5 | 4b27ff1ce4d740814e476ada0b4e01a3 |
|
BLAKE2b-256 | 58e11176ebda5812299c11bc1da88ba3b3d02cfcce5eef63d00e6859d5ef4b10 |
Hashes for aws_cdk.aws_secretsmanager-0.36.1-py3-none-any.whl
Algorithm | Hash digest | |
---|---|---|
SHA256 | f0e97dd4ccff7674948dc5e040fe3c817a46f5036376baed6f837c918990ff76 |
|
MD5 | ba90891a0b497618a74a900daf0cd8bf |
|
BLAKE2b-256 | 0a3a036b773c68285d169ff2f9d273ebd96b4b8c92c3b7d74fba67461ff1f5f1 |