Skip to content

Commit c13b6f9

Browse files
author
awstools
committed
feat(client-secrets-manager): Adds support to create, update, retrieve, rotate, and delete managed external secrets.
1 parent 5774faa commit c13b6f9

26 files changed

+1251
-778
lines changed

clients/client-secrets-manager/src/commands/BatchGetSecretValueCommand.ts

Lines changed: 17 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -27,14 +27,25 @@ export interface BatchGetSecretValueCommandInput extends BatchGetSecretValueRequ
2727
export interface BatchGetSecretValueCommandOutput extends BatchGetSecretValueResponse, __MetadataBearer {}
2828

2929
/**
30-
* <p>Retrieves the contents of the encrypted fields <code>SecretString</code> or <code>SecretBinary</code> for up to 20 secrets. To retrieve a single secret, call <a>GetSecretValue</a>. </p>
31-
* <p>To choose which secrets to retrieve, you can specify a list of secrets by name or ARN, or you can use filters. If Secrets Manager encounters errors such as <code>AccessDeniedException</code> while attempting to retrieve any of the secrets, you can see the errors in <code>Errors</code> in the response.</p>
32-
* <p>Secrets Manager generates CloudTrail <code>GetSecretValue</code> log entries for each secret you request when you call this action. Do not include sensitive information in request parameters because it might be logged. For more information, see <a href="https://docs.aws.amazon.com/secretsmanager/latest/userguide/retrieve-ct-entries.html">Logging Secrets Manager events with CloudTrail</a>.</p>
30+
* <p>Retrieves the contents of the encrypted fields <code>SecretString</code> or
31+
* <code>SecretBinary</code> for up to 20 secrets. To retrieve a single secret, call
32+
* <a>GetSecretValue</a>. </p>
33+
* <p>To choose which secrets to retrieve, you can specify a list of secrets by name or ARN,
34+
* or you can use filters. If Secrets Manager encounters errors such as
35+
* <code>AccessDeniedException</code> while attempting to retrieve any of the secrets,
36+
* you can see the errors in <code>Errors</code> in the response.</p>
37+
* <p>Secrets Manager generates CloudTrail
38+
* <code>GetSecretValue</code> log entries for each secret you request when you call this
39+
* action. Do not include sensitive information in request parameters because it might be
40+
* logged. For more information, see <a href="https://docs.aws.amazon.com/secretsmanager/latest/userguide/retrieve-ct-entries.html">Logging Secrets Manager events with CloudTrail</a>.</p>
3341
* <p>
3442
* <b>Required permissions: </b>
35-
* <code>secretsmanager:BatchGetSecretValue</code>, and you must have <code>secretsmanager:GetSecretValue</code> for each secret. If you use filters, you must also have <code>secretsmanager:ListSecrets</code>. If the secrets are encrypted using customer-managed keys instead of the Amazon Web Services managed key
36-
* <code>aws/secretsmanager</code>, then you also need <code>kms:Decrypt</code> permissions for the keys.
37-
* For more information, see <a href="https://docs.aws.amazon.com/secretsmanager/latest/userguide/reference_iam-permissions.html#reference_iam-permissions_actions">
43+
* <code>secretsmanager:BatchGetSecretValue</code>, and you must have
44+
* <code>secretsmanager:GetSecretValue</code> for each secret. If you use filters, you
45+
* must also have <code>secretsmanager:ListSecrets</code>. If the secrets are encrypted
46+
* using customer-managed keys instead of the Amazon Web Services managed key
47+
* <code>aws/secretsmanager</code>, then you also need <code>kms:Decrypt</code>
48+
* permissions for the keys. For more information, see <a href="https://docs.aws.amazon.com/secretsmanager/latest/userguide/reference_iam-permissions.html#reference_iam-permissions_actions">
3849
* IAM policy actions for Secrets Manager</a> and <a href="https://docs.aws.amazon.com/secretsmanager/latest/userguide/auth-and-access.html">Authentication
3950
* and access control in Secrets Manager</a>. </p>
4051
* @example

clients/client-secrets-manager/src/commands/CancelRotateSecretCommand.ts

Lines changed: 11 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -27,23 +27,21 @@ export interface CancelRotateSecretCommandInput extends CancelRotateSecretReques
2727
export interface CancelRotateSecretCommandOutput extends CancelRotateSecretResponse, __MetadataBearer {}
2828

2929
/**
30-
* <p>Turns off automatic rotation, and if a rotation is currently in
31-
* progress, cancels the rotation.</p>
30+
* <p>Turns off automatic rotation, and if a rotation is currently in progress, cancels the
31+
* rotation.</p>
3232
* <p>If you cancel a rotation in progress, it can leave the <code>VersionStage</code>
33-
* labels in an unexpected state. You might
34-
* need to remove the staging label <code>AWSPENDING</code> from the partially created version.
35-
* You also need to determine whether to roll back to the previous version of the secret
36-
* by moving the staging label <code>AWSCURRENT</code> to the version that has <code>AWSPENDING</code>.
37-
* To determine
38-
* which version has a specific staging label, call <a>ListSecretVersionIds</a>. Then use
39-
* <a>UpdateSecretVersionStage</a> to change staging labels.
40-
* For more information, see <a href="https://docs.aws.amazon.com/secretsmanager/latest/userguide/rotate-secrets_how.html">How rotation works</a>.</p>
33+
* labels in an unexpected state. You might need to remove the staging label
34+
* <code>AWSPENDING</code> from the partially created version. You also need to
35+
* determine whether to roll back to the previous version of the secret by moving the
36+
* staging label <code>AWSCURRENT</code> to the version that has <code>AWSPENDING</code>.
37+
* To determine which version has a specific staging label, call <a>ListSecretVersionIds</a>. Then use <a>UpdateSecretVersionStage</a> to change staging labels. For more information, see <a href="https://docs.aws.amazon.com/secretsmanager/latest/userguide/rotate-secrets_how.html">How rotation
38+
* works</a>.</p>
4139
* <p>To turn on automatic rotation again, call <a>RotateSecret</a>.</p>
4240
* <p>Secrets Manager generates a CloudTrail log entry when you call this action. Do not include sensitive information in request parameters because it might be logged. For more information, see <a href="https://docs.aws.amazon.com/secretsmanager/latest/userguide/retrieve-ct-entries.html">Logging Secrets Manager events with CloudTrail</a>.</p>
4341
* <p>
44-
* <b>Required permissions: </b>
45-
* <code>secretsmanager:CancelRotateSecret</code>.
46-
* For more information, see <a href="https://docs.aws.amazon.com/secretsmanager/latest/userguide/reference_iam-permissions.html#reference_iam-permissions_actions">
42+
* <b>Required permissions:
43+
* </b>
44+
* <code>secretsmanager:CancelRotateSecret</code>. For more information, see <a href="https://docs.aws.amazon.com/secretsmanager/latest/userguide/reference_iam-permissions.html#reference_iam-permissions_actions">
4745
* IAM policy actions for Secrets Manager</a> and <a href="https://docs.aws.amazon.com/secretsmanager/latest/userguide/auth-and-access.html">Authentication
4846
* and access control in Secrets Manager</a>. </p>
4947
* @example

clients/client-secrets-manager/src/commands/CreateSecretCommand.ts

Lines changed: 40 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -28,41 +28,50 @@ export interface CreateSecretCommandOutput extends CreateSecretResponse, __Metad
2828

2929
/**
3030
* <p>Creates a new secret. A <i>secret</i> can be a password, a set of
31-
* credentials such as a user name and password, an OAuth token, or other secret information
32-
* that you store in an encrypted form in Secrets Manager. The secret also
33-
* includes the connection information to access a database or other service, which Secrets Manager
34-
* doesn't encrypt. A secret in Secrets Manager consists of both the protected secret data and the
35-
* important information needed to manage the secret.</p>
36-
* <p>For secrets that use <i>managed rotation</i>, you need to create the secret through the managing service. For more information, see <a href="https://docs.aws.amazon.com/secretsmanager/latest/userguide/service-linked-secrets.html">Secrets Manager secrets managed by other Amazon Web Services services</a>.
37-
*
38-
* </p>
39-
* <p>For information about creating a secret in the console, see <a href="https://docs.aws.amazon.com/secretsmanager/latest/userguide/manage_create-basic-secret.html">Create a secret</a>.</p>
31+
* credentials such as a user name and password, an OAuth token, or other secret
32+
* information that you store in an encrypted form in Secrets Manager. The secret also includes the
33+
* connection information to access a database or other service, which Secrets Manager doesn't
34+
* encrypt. A secret in Secrets Manager consists of both the protected secret data and the important
35+
* information needed to manage the secret.</p>
36+
* <p>For secrets that use <i>managed rotation</i>, you need to create the
37+
* secret through the managing service. For more information, see <a href="https://docs.aws.amazon.com/secretsmanager/latest/userguide/service-linked-secrets.html">Secrets Manager secrets
38+
* managed by other Amazon Web Services services</a>. </p>
39+
* <p>For information about creating a secret in the console, see <a href="https://docs.aws.amazon.com/secretsmanager/latest/userguide/manage_create-basic-secret.html">Create a
40+
* secret</a>.</p>
4041
* <p>To create a secret, you can provide the secret value to be encrypted in either the
41-
* <code>SecretString</code> parameter or the <code>SecretBinary</code> parameter, but not both.
42-
* If you include <code>SecretString</code> or <code>SecretBinary</code>
43-
* then Secrets Manager creates an initial secret version and automatically attaches the staging
44-
* label <code>AWSCURRENT</code> to it.</p>
45-
* <p>For database credentials you want to rotate, for Secrets Manager to be able to rotate the secret,
46-
* you must make sure the JSON you store in the <code>SecretString</code> matches the <a href="https://docs.aws.amazon.com/secretsmanager/latest/userguide/reference_secret_json_structure.html">JSON structure of
47-
* a database secret</a>.</p>
42+
* <code>SecretString</code> parameter or the <code>SecretBinary</code> parameter, but
43+
* not both. If you include <code>SecretString</code> or <code>SecretBinary</code> then
44+
* Secrets Manager creates an initial secret version and automatically attaches the staging label
45+
* <code>AWSCURRENT</code> to it.</p>
46+
* <p>For database credentials you want to rotate, for Secrets Manager to be able to rotate the
47+
* secret, you must make sure the JSON you store in the <code>SecretString</code> matches
48+
* the <a href="https://docs.aws.amazon.com/secretsmanager/latest/userguide/reference_secret_json_structure.html">JSON
49+
* structure of a database secret</a>.</p>
4850
* <p>If you don't specify an KMS encryption key, Secrets Manager uses the Amazon Web Services managed key
49-
* <code>aws/secretsmanager</code>. If this key
50-
* doesn't already exist in your account, then Secrets Manager creates it for you automatically. All
51-
* users and roles in the Amazon Web Services account automatically have access to use <code>aws/secretsmanager</code>.
52-
* Creating <code>aws/secretsmanager</code> can result in a one-time significant delay in returning the
53-
* result.</p>
54-
* <p>If the secret is in a different Amazon Web Services account from the credentials calling the API, then
55-
* you can't use <code>aws/secretsmanager</code> to encrypt the secret, and you must create
56-
* and use a customer managed KMS key. </p>
57-
* <p>Secrets Manager generates a CloudTrail log entry when you call this action. Do not include sensitive information in request parameters except <code>SecretBinary</code> or <code>SecretString</code> because it might be logged. For more information, see <a href="https://docs.aws.amazon.com/secretsmanager/latest/userguide/retrieve-ct-entries.html">Logging Secrets Manager events with CloudTrail</a>.</p>
51+
* <code>aws/secretsmanager</code>. If this key doesn't already exist in your account,
52+
* then Secrets Manager creates it for you automatically. All users and roles in the Amazon Web Services account
53+
* automatically have access to use <code>aws/secretsmanager</code>. Creating
54+
* <code>aws/secretsmanager</code> can result in a one-time significant delay in
55+
* returning the result.</p>
56+
* <p>If the secret is in a different Amazon Web Services account from the credentials calling the API,
57+
* then you can't use <code>aws/secretsmanager</code> to encrypt the secret, and you must
58+
* create and use a customer managed KMS key. </p>
59+
* <p>Secrets Manager generates a CloudTrail log entry when you call this action.
60+
* Do not include sensitive information in request parameters except
61+
* <code>SecretBinary</code> or <code>SecretString</code> because it might be logged.
62+
* For more information, see <a href="https://docs.aws.amazon.com/secretsmanager/latest/userguide/retrieve-ct-entries.html">Logging Secrets Manager events with CloudTrail</a>.</p>
5863
* <p>
59-
* <b>Required permissions: </b>
60-
* <code>secretsmanager:CreateSecret</code>. If you
61-
* include tags in the secret, you also need <code>secretsmanager:TagResource</code>. To add replica Regions, you must also have <code>secretsmanager:ReplicateSecretToRegions</code>.
62-
* For more information, see <a href="https://docs.aws.amazon.com/secretsmanager/latest/userguide/reference_iam-permissions.html#reference_iam-permissions_actions">
64+
* <b>Required permissions:
65+
* </b>
66+
* <code>secretsmanager:CreateSecret</code>. If you include tags in the
67+
* secret, you also need <code>secretsmanager:TagResource</code>. To add replica Regions,
68+
* you must also have <code>secretsmanager:ReplicateSecretToRegions</code>.
69+
* For more information, see <a href="https://docs.aws.amazon.com/secretsmanager/latest/userguide/reference_iam-permissions.html#reference_iam-permissions_actions">
6370
* IAM policy actions for Secrets Manager</a> and <a href="https://docs.aws.amazon.com/secretsmanager/latest/userguide/auth-and-access.html">Authentication
6471
* and access control in Secrets Manager</a>. </p>
65-
* <p>To encrypt the secret with a KMS key other than <code>aws/secretsmanager</code>, you need <code>kms:GenerateDataKey</code> and <code>kms:Decrypt</code> permission to the key. </p>
72+
* <p>To encrypt the secret with a KMS key other than <code>aws/secretsmanager</code>, you
73+
* need <code>kms:GenerateDataKey</code> and <code>kms:Decrypt</code> permission to the
74+
* key. </p>
6675
* <important>
6776
* <p>When you enter commands in a command shell, there is a risk of the command history being accessed or utilities having access to your command parameters. This is a concern if the command includes the value of a secret. Learn how to <a href="https://docs.aws.amazon.com/secretsmanager/latest/userguide/security_cli-exposure-risks.html">Mitigate the risks of using command-line tools to store Secrets Manager secrets</a>.</p>
6877
* </important>
@@ -94,6 +103,7 @@ export interface CreateSecretCommandOutput extends CreateSecretResponse, __Metad
94103
* },
95104
* ],
96105
* ForceOverwriteReplicaSecret: true || false,
106+
* Type: "STRING_VALUE",
97107
* };
98108
* const command = new CreateSecretCommand(input);
99109
* const response = await client.send(command);

clients/client-secrets-manager/src/commands/DeleteResourcePolicyCommand.ts

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -27,13 +27,13 @@ export interface DeleteResourcePolicyCommandInput extends DeleteResourcePolicyRe
2727
export interface DeleteResourcePolicyCommandOutput extends DeleteResourcePolicyResponse, __MetadataBearer {}
2828

2929
/**
30-
* <p>Deletes the resource-based permission policy attached to the secret. To attach a policy to
31-
* a secret, use <a>PutResourcePolicy</a>.</p>
30+
* <p>Deletes the resource-based permission policy attached to the secret. To attach a
31+
* policy to a secret, use <a>PutResourcePolicy</a>.</p>
3232
* <p>Secrets Manager generates a CloudTrail log entry when you call this action. Do not include sensitive information in request parameters because it might be logged. For more information, see <a href="https://docs.aws.amazon.com/secretsmanager/latest/userguide/retrieve-ct-entries.html">Logging Secrets Manager events with CloudTrail</a>.</p>
3333
* <p>
34-
* <b>Required permissions: </b>
35-
* <code>secretsmanager:DeleteResourcePolicy</code>.
36-
* For more information, see <a href="https://docs.aws.amazon.com/secretsmanager/latest/userguide/reference_iam-permissions.html#reference_iam-permissions_actions">
34+
* <b>Required permissions:
35+
* </b>
36+
* <code>secretsmanager:DeleteResourcePolicy</code>. For more information, see <a href="https://docs.aws.amazon.com/secretsmanager/latest/userguide/reference_iam-permissions.html#reference_iam-permissions_actions">
3737
* IAM policy actions for Secrets Manager</a> and <a href="https://docs.aws.amazon.com/secretsmanager/latest/userguide/auth-and-access.html">Authentication
3838
* and access control in Secrets Manager</a>. </p>
3939
* @example

0 commit comments

Comments
 (0)