You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
* <p>Retrieves the contents of the encrypted fields <code>SecretString</code> or <code>SecretBinary</code> for up to 20 secrets. To retrieve a single secret, call <a>GetSecretValue</a>. </p>
31
-
* <p>To choose which secrets to retrieve, you can specify a list of secrets by name or ARN, or you can use filters. If Secrets Manager encounters errors such as <code>AccessDeniedException</code> while attempting to retrieve any of the secrets, you can see the errors in <code>Errors</code> in the response.</p>
32
-
* <p>Secrets Manager generates CloudTrail <code>GetSecretValue</code> log entries for each secret you request when you call this action. Do not include sensitive information in request parameters because it might be logged. For more information, see <a href="https://docs.aws.amazon.com/secretsmanager/latest/userguide/retrieve-ct-entries.html">Logging Secrets Manager events with CloudTrail</a>.</p>
30
+
* <p>Retrieves the contents of the encrypted fields <code>SecretString</code> or
31
+
* <code>SecretBinary</code> for up to 20 secrets. To retrieve a single secret, call
32
+
* <a>GetSecretValue</a>. </p>
33
+
* <p>To choose which secrets to retrieve, you can specify a list of secrets by name or ARN,
34
+
* or you can use filters. If Secrets Manager encounters errors such as
35
+
* <code>AccessDeniedException</code> while attempting to retrieve any of the secrets,
36
+
* you can see the errors in <code>Errors</code> in the response.</p>
37
+
* <p>Secrets Manager generates CloudTrail
38
+
* <code>GetSecretValue</code> log entries for each secret you request when you call this
39
+
* action. Do not include sensitive information in request parameters because it might be
40
+
* logged. For more information, see <a href="https://docs.aws.amazon.com/secretsmanager/latest/userguide/retrieve-ct-entries.html">Logging Secrets Manager events with CloudTrail</a>.</p>
33
41
* <p>
34
42
* <b>Required permissions: </b>
35
-
* <code>secretsmanager:BatchGetSecretValue</code>, and you must have <code>secretsmanager:GetSecretValue</code> for each secret. If you use filters, you must also have <code>secretsmanager:ListSecrets</code>. If the secrets are encrypted using customer-managed keys instead of the Amazon Web Services managed key
36
-
* <code>aws/secretsmanager</code>, then you also need <code>kms:Decrypt</code> permissions for the keys.
37
-
* For more information, see <a href="https://docs.aws.amazon.com/secretsmanager/latest/userguide/reference_iam-permissions.html#reference_iam-permissions_actions">
43
+
* <code>secretsmanager:BatchGetSecretValue</code>, and you must have
44
+
* <code>secretsmanager:GetSecretValue</code> for each secret. If you use filters, you
45
+
* must also have <code>secretsmanager:ListSecrets</code>. If the secrets are encrypted
46
+
* using customer-managed keys instead of the Amazon Web Services managed key
47
+
* <code>aws/secretsmanager</code>, then you also need <code>kms:Decrypt</code>
48
+
* permissions for the keys. For more information, see <a href="https://docs.aws.amazon.com/secretsmanager/latest/userguide/reference_iam-permissions.html#reference_iam-permissions_actions">
38
49
* IAM policy actions for Secrets Manager</a> and <a href="https://docs.aws.amazon.com/secretsmanager/latest/userguide/auth-and-access.html">Authentication
* <p>Turns off automatic rotation, and if a rotation is currently in
31
-
* progress, cancels the rotation.</p>
30
+
* <p>Turns off automatic rotation, and if a rotation is currently in progress, cancels the
31
+
* rotation.</p>
32
32
* <p>If you cancel a rotation in progress, it can leave the <code>VersionStage</code>
33
-
* labels in an unexpected state. You might
34
-
* need to remove the staging label <code>AWSPENDING</code> from the partially created version.
35
-
* You also need to determine whether to roll back to the previous version of the secret
36
-
* by moving the staging label <code>AWSCURRENT</code> to the version that has <code>AWSPENDING</code>.
37
-
* To determine
38
-
* which version has a specific staging label, call <a>ListSecretVersionIds</a>. Then use
39
-
* <a>UpdateSecretVersionStage</a> to change staging labels.
40
-
* For more information, see <a href="https://docs.aws.amazon.com/secretsmanager/latest/userguide/rotate-secrets_how.html">How rotation works</a>.</p>
33
+
* labels in an unexpected state. You might need to remove the staging label
34
+
* <code>AWSPENDING</code> from the partially created version. You also need to
35
+
* determine whether to roll back to the previous version of the secret by moving the
36
+
* staging label <code>AWSCURRENT</code> to the version that has <code>AWSPENDING</code>.
37
+
* To determine which version has a specific staging label, call <a>ListSecretVersionIds</a>. Then use <a>UpdateSecretVersionStage</a> to change staging labels. For more information, see <a href="https://docs.aws.amazon.com/secretsmanager/latest/userguide/rotate-secrets_how.html">How rotation
38
+
* works</a>.</p>
41
39
* <p>To turn on automatic rotation again, call <a>RotateSecret</a>.</p>
42
40
* <p>Secrets Manager generates a CloudTrail log entry when you call this action. Do not include sensitive information in request parameters because it might be logged. For more information, see <a href="https://docs.aws.amazon.com/secretsmanager/latest/userguide/retrieve-ct-entries.html">Logging Secrets Manager events with CloudTrail</a>.</p>
43
41
* <p>
44
-
* <b>Required permissions: </b>
45
-
* <code>secretsmanager:CancelRotateSecret</code>.
46
-
* For more information, see <a href="https://docs.aws.amazon.com/secretsmanager/latest/userguide/reference_iam-permissions.html#reference_iam-permissions_actions">
42
+
* <b>Required permissions:
43
+
* </b>
44
+
* <code>secretsmanager:CancelRotateSecret</code>. For more information, see <a href="https://docs.aws.amazon.com/secretsmanager/latest/userguide/reference_iam-permissions.html#reference_iam-permissions_actions">
47
45
* IAM policy actions for Secrets Manager</a> and <a href="https://docs.aws.amazon.com/secretsmanager/latest/userguide/auth-and-access.html">Authentication
* <p>Creates a new secret. A <i>secret</i> can be a password, a set of
31
-
* credentials such as a user name and password, an OAuth token, or other secret information
32
-
* that you store in an encrypted form in Secrets Manager. The secret also
33
-
* includes the connection information to access a database or other service, which Secrets Manager
34
-
* doesn't encrypt. A secret in Secrets Manager consists of both the protected secret data and the
35
-
* important information needed to manage the secret.</p>
36
-
* <p>For secrets that use <i>managed rotation</i>, you need to create the secret through the managing service. For more information, see <a href="https://docs.aws.amazon.com/secretsmanager/latest/userguide/service-linked-secrets.html">Secrets Manager secrets managed by other Amazon Web Services services</a>.
37
-
*
38
-
* </p>
39
-
* <p>For information about creating a secret in the console, see <a href="https://docs.aws.amazon.com/secretsmanager/latest/userguide/manage_create-basic-secret.html">Create a secret</a>.</p>
31
+
* credentials such as a user name and password, an OAuth token, or other secret
32
+
* information that you store in an encrypted form in Secrets Manager. The secret also includes the
33
+
* connection information to access a database or other service, which Secrets Manager doesn't
34
+
* encrypt. A secret in Secrets Manager consists of both the protected secret data and the important
35
+
* information needed to manage the secret.</p>
36
+
* <p>For secrets that use <i>managed rotation</i>, you need to create the
37
+
* secret through the managing service. For more information, see <a href="https://docs.aws.amazon.com/secretsmanager/latest/userguide/service-linked-secrets.html">Secrets Manager secrets
38
+
* managed by other Amazon Web Services services</a>. </p>
39
+
* <p>For information about creating a secret in the console, see <a href="https://docs.aws.amazon.com/secretsmanager/latest/userguide/manage_create-basic-secret.html">Create a
40
+
* secret</a>.</p>
40
41
* <p>To create a secret, you can provide the secret value to be encrypted in either the
41
-
* <code>SecretString</code> parameter or the <code>SecretBinary</code> parameter, but not both.
42
-
* If you include <code>SecretString</code> or <code>SecretBinary</code>
43
-
* then Secrets Manager creates an initial secret version and automatically attaches the staging
44
-
* label <code>AWSCURRENT</code> to it.</p>
45
-
* <p>For database credentials you want to rotate, for Secrets Manager to be able to rotate the secret,
46
-
* you must make sure the JSON you store in the <code>SecretString</code> matches the <a href="https://docs.aws.amazon.com/secretsmanager/latest/userguide/reference_secret_json_structure.html">JSON structure of
47
-
* a database secret</a>.</p>
42
+
* <code>SecretString</code> parameter or the <code>SecretBinary</code> parameter, but
43
+
* not both. If you include <code>SecretString</code> or <code>SecretBinary</code> then
44
+
* Secrets Manager creates an initial secret version and automatically attaches the staging label
45
+
* <code>AWSCURRENT</code> to it.</p>
46
+
* <p>For database credentials you want to rotate, for Secrets Manager to be able to rotate the
47
+
* secret, you must make sure the JSON you store in the <code>SecretString</code> matches
48
+
* the <a href="https://docs.aws.amazon.com/secretsmanager/latest/userguide/reference_secret_json_structure.html">JSON
49
+
* structure of a database secret</a>.</p>
48
50
* <p>If you don't specify an KMS encryption key, Secrets Manager uses the Amazon Web Services managed key
49
-
* <code>aws/secretsmanager</code>. If this key
50
-
* doesn't already exist in your account, then Secrets Manager creates it for you automatically. All
51
-
* users and roles in the Amazon Web Services account automatically have access to use <code>aws/secretsmanager</code>.
52
-
* Creating <code>aws/secretsmanager</code> can result in a one-time significant delay in returning the
53
-
* result.</p>
54
-
* <p>If the secret is in a different Amazon Web Services account from the credentials calling the API, then
55
-
* you can't use <code>aws/secretsmanager</code> to encrypt the secret, and you must create
56
-
* and use a customer managed KMS key. </p>
57
-
* <p>Secrets Manager generates a CloudTrail log entry when you call this action. Do not include sensitive information in request parameters except <code>SecretBinary</code> or <code>SecretString</code> because it might be logged. For more information, see <a href="https://docs.aws.amazon.com/secretsmanager/latest/userguide/retrieve-ct-entries.html">Logging Secrets Manager events with CloudTrail</a>.</p>
51
+
* <code>aws/secretsmanager</code>. If this key doesn't already exist in your account,
52
+
* then Secrets Manager creates it for you automatically. All users and roles in the Amazon Web Services account
53
+
* automatically have access to use <code>aws/secretsmanager</code>. Creating
54
+
* <code>aws/secretsmanager</code> can result in a one-time significant delay in
55
+
* returning the result.</p>
56
+
* <p>If the secret is in a different Amazon Web Services account from the credentials calling the API,
57
+
* then you can't use <code>aws/secretsmanager</code> to encrypt the secret, and you must
58
+
* create and use a customer managed KMS key. </p>
59
+
* <p>Secrets Manager generates a CloudTrail log entry when you call this action.
60
+
* Do not include sensitive information in request parameters except
61
+
* <code>SecretBinary</code> or <code>SecretString</code> because it might be logged.
62
+
* For more information, see <a href="https://docs.aws.amazon.com/secretsmanager/latest/userguide/retrieve-ct-entries.html">Logging Secrets Manager events with CloudTrail</a>.</p>
58
63
* <p>
59
-
* <b>Required permissions: </b>
60
-
* <code>secretsmanager:CreateSecret</code>. If you
61
-
* include tags in the secret, you also need <code>secretsmanager:TagResource</code>. To add replica Regions, you must also have <code>secretsmanager:ReplicateSecretToRegions</code>.
62
-
* For more information, see <a href="https://docs.aws.amazon.com/secretsmanager/latest/userguide/reference_iam-permissions.html#reference_iam-permissions_actions">
64
+
* <b>Required permissions:
65
+
* </b>
66
+
* <code>secretsmanager:CreateSecret</code>. If you include tags in the
67
+
* secret, you also need <code>secretsmanager:TagResource</code>. To add replica Regions,
68
+
* you must also have <code>secretsmanager:ReplicateSecretToRegions</code>.
69
+
* For more information, see <a href="https://docs.aws.amazon.com/secretsmanager/latest/userguide/reference_iam-permissions.html#reference_iam-permissions_actions">
63
70
* IAM policy actions for Secrets Manager</a> and <a href="https://docs.aws.amazon.com/secretsmanager/latest/userguide/auth-and-access.html">Authentication
64
71
* and access control in Secrets Manager</a>. </p>
65
-
* <p>To encrypt the secret with a KMS key other than <code>aws/secretsmanager</code>, you need <code>kms:GenerateDataKey</code> and <code>kms:Decrypt</code> permission to the key. </p>
72
+
* <p>To encrypt the secret with a KMS key other than <code>aws/secretsmanager</code>, you
73
+
* need <code>kms:GenerateDataKey</code> and <code>kms:Decrypt</code> permission to the
74
+
* key. </p>
66
75
* <important>
67
76
* <p>When you enter commands in a command shell, there is a risk of the command history being accessed or utilities having access to your command parameters. This is a concern if the command includes the value of a secret. Learn how to <a href="https://docs.aws.amazon.com/secretsmanager/latest/userguide/security_cli-exposure-risks.html">Mitigate the risks of using command-line tools to store Secrets Manager secrets</a>.</p>
* <p>Deletes the resource-based permission policy attached to the secret. To attach a policy to
31
-
* a secret, use <a>PutResourcePolicy</a>.</p>
30
+
* <p>Deletes the resource-based permission policy attached to the secret. To attach a
31
+
* policy to a secret, use <a>PutResourcePolicy</a>.</p>
32
32
* <p>Secrets Manager generates a CloudTrail log entry when you call this action. Do not include sensitive information in request parameters because it might be logged. For more information, see <a href="https://docs.aws.amazon.com/secretsmanager/latest/userguide/retrieve-ct-entries.html">Logging Secrets Manager events with CloudTrail</a>.</p>
* For more information, see <a href="https://docs.aws.amazon.com/secretsmanager/latest/userguide/reference_iam-permissions.html#reference_iam-permissions_actions">
34
+
* <b>Required permissions:
35
+
* </b>
36
+
* <code>secretsmanager:DeleteResourcePolicy</code>. For more information, see <a href="https://docs.aws.amazon.com/secretsmanager/latest/userguide/reference_iam-permissions.html#reference_iam-permissions_actions">
37
37
* IAM policy actions for Secrets Manager</a> and <a href="https://docs.aws.amazon.com/secretsmanager/latest/userguide/auth-and-access.html">Authentication
0 commit comments