The CDK Construct Library for AWS::SecretsManager
Project description
AWS Secrets Manager Construct Library
This is a developer preview (public beta) module. Releases might lack important features and might have future breaking changes.
const secretsmanager = require('@aws-cdk/aws-secretsmanager');
Create a new Secret in a Stack
In order to have SecretsManager generate a new secret value automatically, you can get started with the following:
// Default secret
const secret = new secretsManager.Secret(this, 'Secret');
secret.grantRead(role);
new iam.User(this, 'User', {
password: secret.secretValue
});
// Templated secret
const templatedSecret = new secretsManager.Secret(this, 'TemplatedSecret', {
generateSecretString: {
secretStringTemplate: JSON.stringify({ username: 'user' }),
generateStringKey: 'password'
}
});
new iam.User(this, 'OtherUser', {
userName: templatedSecret.secretValueFromJson('username').toString(),
password: templatedSecret.secretValueFromJson('password')
});
The Secret
construct does not allow specifying the SecretString
property
of the AWS::SecretsManager::Secret
resource (as this will almost always
lead to the secret being surfaced in plain text and possibly committed to
your source control).
If you need to use a pre-existing secret, the recommended way is to manually
provision the secret in AWS SecretsManager and use the Secret.fromSecretArn
or Secret.fromSecretAttributes
method to make it available in your CDK Application:
const secret = Secret.fromSecretAttributes(scope, 'ImportedSecret', {
secretArn: 'arn:aws:secretsmanager:<region>:<account-id-number>:secret:<secret-name>-<random-6-characters>',
// If the secret is encrypted using a KMS-hosted CMK, either import or reference that key:
encryptionKey,
});
SecretsManager secret values can only be used in select set of properties. For the list of properties, see the CloudFormation Dynamic References documentation.
Rotating a Secret
A rotation schedule can be added to a Secret:
const fn = new lambda.Function(...);
const secret = new secretsManager.Secret(this, 'Secret');
secret.addRotationSchedule('RotationSchedule', {
rotationLambda: fn,
automaticallyAfterDays: 15
});
See Overview of the Lambda Rotation Function on how to implement a Lambda Rotation Function.
For RDS credentials rotation, see aws-rds.
Project details
Release history Release notifications | RSS feed
Download files
Download the file for your platform. If you're not sure which to choose, learn more about installing packages.
Source Distribution
Built Distribution
Hashes for aws-cdk.aws-secretsmanager-0.38.0.tar.gz
Algorithm | Hash digest | |
---|---|---|
SHA256 | 35e368778d3dd14eed3630be9b93834555d91997b6c3794189f3c57ac456a4c9 |
|
MD5 | 0710b1c53ca143db5172a664038dfd1e |
|
BLAKE2b-256 | 8562f88c440a6167033ff707895f9d45f9832d59f39e80a2a37b0ff6791c6447 |
Hashes for aws_cdk.aws_secretsmanager-0.38.0-py3-none-any.whl
Algorithm | Hash digest | |
---|---|---|
SHA256 | 190dd59a05d1e46466f171678c5ce99112b72bea4f9dbbe1047eaecb93c7c7eb |
|
MD5 | 62078141fa873559e15e3aaedb039d0d |
|
BLAKE2b-256 | 6e8ac92dec5fddbb0b7f48513070673707cdda46cd678c244b6efe42cf5303a9 |