AWS Secrets Manager Construct Library
const secretsmanager = require('@aws-cdk/aws-secretsmanager');
Create a new Secret in a Stack
In order to have SecretsManager generate a new secret value automatically,
you can get started with the following:
example of creating a secret
The Secret
construct does not allow specifying the SecretString
property
of the AWS::SecretsManager::Secret
resource (as this will almost always
lead to the secret being surfaced in plain text and possibly committed to
your source control).
If you need to use a pre-existing secret, the recommended way is to manually
provision the secret in AWS SecretsManager and use the Secret.fromSecretArn
or Secret.fromSecretAttributes
method to make it available in your CDK Application:
const secret = secretsmanager.Secret.fromSecretAttributes(scope, 'ImportedSecret', {
secretArn: 'arn:aws:secretsmanager:<region>:<account-id-number>:secret:<secret-name>-<random-6-characters>',
encryptionKey,
});
SecretsManager secret values can only be used in select set of properties. For the
list of properties, see the CloudFormation Dynamic References documentation.
Rotating a Secret
A rotation schedule can be added to a Secret:
const fn = new lambda.Function(...);
const secret = new secretsmanager.Secret(this, 'Secret');
secret.addRotationSchedule('RotationSchedule', {
rotationLambda: fn,
automaticallyAfter: Duration.days(15)
});
See Overview of the Lambda Rotation Function on how to implement a Lambda Rotation Function.
For RDS credentials rotation, see aws-rds.