@aws-cdk/aws-secretsmanager
Advanced tools
This is a developer preview (public beta) module. Releases might lack important features and might have future breaking changes.
This API is still under active development and subject to non-backward compatible changes or removal in any future version. Use of the API is not recommended in production environments. Experimental APIs are not subject to the Semantic Versioning model.
const secretsmanager = require('@aws-cdk/aws-secretsmanager');
In order to have SecretsManager generate a new secret value automatically, you can get started with the following:
The Secret construct does not allow specifying the SecretString property
of the AWS::SecretsManager::Secret resource (as this will almost always
lead to the secret being surfaced in plain text and possibly committed to
your source control).
If you need to use a pre-existing secret, the recommended way is to manually
provision the secret in AWS SecretsManager and use the Secret.import
method to make it available in your CDK Application:
const secret = Secret.import(scope, 'ImportedSecret', {
secretArn: 'arn:aws:secretsmanager:<region>:<account-id-number>:secret:<secret-name>-<random-6-characters>',
// If the secret is encrypted using a KMS-hosted CMK, either import or reference that key:
encryptionKey,
});
SecretsManager secret values can only be used in select set of properties. For the list of properties, see the CloudFormation Dynamic References documentation.
A rotation schedule can be added to a Secret:
const fn = new lambda.Function(...);
const secret = new secretsManager.Secret(this, 'Secret');
secret.addRotationSchedule('RotationSchedule', {
rotationLambda: fn,
automaticallyAfterDays: 15
});
See Overview of the Lambda Rotation Function on how to implement a Lambda Rotation Function.
For RDS credentials rotation, see aws-rds.
0.35.0 (2019-06-19)
cdk context (#2870) (b8a1c8e), closes #2854name in StageProps to stageName. (#2882) (be574a1)hwType to hardwareType (#2916) (1aa0589), closes #2896aws-sns-subscribers (#2804) (9ef899c)AssetProps.packaging has been removed and is now automatically discovered based on the file type.ZipDirectoryAsset has been removed, use aws-s3-assets.Asset.FileAsset has been removed, use aws-s3-assets.Asset.Code.directory and Code.file have been removed. Use Code.asset.hardwareType from hwType.TableOptions.pitrEnabled renamed to pointInTimeRecovery.TableOptions.sseEnabled renamed to serverSideEncryption.TableOptions.ttlAttributeName renamed to timeToLiveAttribute.TableOptions.streamSpecification renamed stream.ContainerImage.fromAsset() now takes only build directory
directly (no need to pass scope or id anymore).ISecret.secretJsonValue renamed to secretValueFromJson.ParameterStoreString has been removed. Use StringParameter.fromStringParameterAttributes.ParameterStoreSecureString has been removed. Use StringParameter.fromSecureStringParameterAttributes.ParameterOptions.name was renamed to parameterName.newStream renamed to addStream and doesn't need a scopenewSubscriptionFilter renamed to addSubscriptionFilter and doesn't need a scopenewMetricFilter renamed to addMetricFilter and doesn't need a scopeNewSubscriptionFilterProps renamed to SubscriptionPropsNewLogStreamProps renamed to LogStreamOptionsNewMetricFilterProps renamed to MetricFilterOptionsJSONPattern renamed to JsonPatternMethodOptions.authorizerId is now called authorizer and accepts an IAuthorizer which is a placeholder interface for the authorizer resource.restapi.executeApiArn renamed to arnForExecuteApi.restapi.latestDeployment and deploymentStage are now read-only.EventPattern.detail is now a map.scheduleExpression: string is now schedule: Schedule.cdk.RemovalPolicy
to configure the resource's removal policy.applyRemovalPolicy is now CfnResource.applyRemovalPolicy.RemovalPolicy.Orphan has been renamed to Retain.RemovalPolicy.Forbid has been removed, use Retain.RepositoryProps.retain is now removalPolicy, and defaults to Retain instead of remove since ECR is a stateful resourceKeyProps.retain is now removalPolicyLogGroupProps.retainLogGroup is now removalPolicyLogStreamProps.retainLogStream is now removalPolicyDatabaseClusterProps.deleteReplacePolicy is now removalPolicyDatabaseInstanceNewProps.deleteReplacePolicy is now removalPolicyattr instead of the resource type. For example, in S3 bucket.bucketArn is now bucket.attrArn.propertyOverrides has been removed from all "Cfn" resources, instead
users can now read/write resource properties directly on the resource class. For example, instead of lambda.propertyOverrides.runtime just use lambda.runtime.stageName instead of nameFunction.addLayer to addLayers and made it variadicIFunction.handler propertyIVersion.versionArn property (the value is at functionArn)SingletonLayerVersionLogRetentionPolicyStatement no longer has a fluid API, and accepts a
props object to be able to set the important fields.ImportedResourcePrincipal to UnknownPrincipal.managedPolicyArns renamed to managedPolicies, takes
return value from ManagedPolicy.fromAwsManagedPolicyName().PolicyDocument.postProcess() is now removed.PolicyDocument.addStatement() renamed to addStatements.PolicyStatement is no longer IResolvable, call .toStatementJson()
to retrieve the IAM policy statement JSON.AwsPrincipal has been removed, use ArnPrincipal instead.s3.StorageClass is now an enum-like class instead of a regular
enum. This means that you need to call .value in order to obtain it's value.s3.Coordinates renamed to s3.LocationArtifact.s3Coordinates renamed to Artifact.s3Location.BuildSpec object.lambda.Runtime.NodeJS* are now lambda.Runtime.Nodejs*Stack APIstack.name renamed to stack.stackNamestack.stackName will return the concrete stack name. Use Aws.stackName to indicate { Ref: "AWS::StackName" }.stack.account and stack.region will return the concrete account/region only if they are explicitly specified when the stack is defined (under the env prop). Otherwise, they will return a token that resolves to the AWS::AccountId and AWS::Region intrinsic references. Use Context.getDefaultAccount() and Context.getDefaultRegion() to obtain the defaults passed through the toolkit in case those are needed. Use Token.isUnresolved(v) to check if you have a concrete or intrinsic.stack.logicalId has been removed. Use stack.getLogicalId()stack.env has been removed, use stack.account, stack.region and stack.environment insteadstack.accountId renamed to stack.account (to allow treating account more abstractly)AvailabilityZoneProvider can now be accessed through Context.getAvailabilityZones()SSMParameterProvider can now be accessed through Context.getSsmParameter()parseArn is now Arn.parsearnFromComponents is now arn.formatnode.lock and node.unlock are now privatestack.requireRegion and requireAccountId have been removed. Use Token.unresolved(stack.region) insteadstack.parentApp have been removed. Use App.isApp(stack.node.root) instead.stack.missingContext is now privatestack.renameLogical have been renamed to stack.renameLogicalIdIAddressingScheme, HashedAddressingScheme and LogicalIDs are now internal. Override Stack.allocateLogicalId to customize how logical IDs are allocated to resources.--rename, and the stack
names are now immutable on the stack artifact.@aws-cdk/aws-sns-subscribers
package.roleName in RoleProps is now of type PhysicalNamebucketName in BucketProps is now of type PhysicalNameroleName in RoleProps is now of type PhysicalNameFAQs
The CDK Construct Library for AWS::SecretsManager
The npm package @aws-cdk/aws-secretsmanager receives a total of 65,316 weekly downloads. As such, @aws-cdk/aws-secretsmanager popularity was classified as popular.
We found that @aws-cdk/aws-secretsmanager demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 4 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket is tracking a new trend where malicious actors are now exploiting the popularity of LLM research to spread malware through seemingly useful open source packages.
Security News
Research
Noxia, a new dark web bulletproof host, offers dirt cheap servers for Python, Node.js, Go, and Rust, enabling cybercriminals to distribute malware and execute supply chain attacks.
Company News
Socket safeguards companies from software supply chain attacks by detecting and preventing threats in open source code and empowering developers to secure their applications and critical services against malware and other security risks.