@aws-cdk/aws-secretsmanager

AWS Secrets Manager Construct Library

---

---

const secretsmanager = require('@aws-cdk/aws-secretsmanager');

Create a new Secret in a Stack

In order to have SecretsManager generate a new secret value automatically, you can get started with the following:

example of creating a secret

The Secret construct does not allow specifying the SecretString property of the AWS::SecretsManager::Secret resource (as this will almost always lead to the secret being surfaced in plain text and possibly committed to your source control).

If you need to use a pre-existing secret, the recommended way is to manually provision the secret in AWS SecretsManager and use the Secret.fromSecretArn or Secret.fromSecretAttributes method to make it available in your CDK Application:

const secret = secretsmanager.Secret.fromSecretAttributes(scope, 'ImportedSecret', {
  secretArn: 'arn:aws:secretsmanager:<region>:<account-id-number>:secret:<secret-name>-<random-6-characters>',
  // If the secret is encrypted using a KMS-hosted CMK, either import or reference that key:
  encryptionKey,
});

SecretsManager secret values can only be used in select set of properties. For the list of properties, see the CloudFormation Dynamic References documentation.

Rotating a Secret with a custom Lambda function

A rotation schedule can be added to a Secret using a custom Lambda function:

const fn = new lambda.Function(...);
const secret = new secretsmanager.Secret(this, 'Secret');

secret.addRotationSchedule('RotationSchedule', {
  rotationLambda: fn,
  automaticallyAfter: Duration.days(15)
});

See Overview of the Lambda Rotation Function on how to implement a Lambda Rotation Function.

Rotating database credentials

Define a SecretRotation to rotate database credentials:

new SecretRotation(this, 'SecretRotation', {
  application: SecretRotationApplication.MYSQL_ROTATION_SINGLE_USER, // MySQL single user scheme
  secret: mySecret,
  target: myDatabase, // a Connectable
  vpc: myVpc, // The VPC where the secret rotation application will be deployed
});

The secret must be a JSON string with the following format:

{
  "engine": "<required: database engine>",
  "host": "<required: instance host name>",
  "username": "<required: username>",
  "password": "<required: password>",
  "dbname": "<optional: database name>",
  "port": "<optional: if not specified, default port will be used>",
  "masterarn": "<required for multi user rotation: the arn of the master secret which will be used to create users/change passwords>"
}

For the multi user scheme, a masterSecret must be specified:

new SecretRotation(stack, 'SecretRotation', {
  application: SecretRotationApplication.MYSQL_ROTATION_MULTI_USER,
  secret: myUserSecret, // The secret that will be rotated
  masterSecret: myMasterSecret, // The secret used for the rotation
  target: myDatabase,
  vpc: myVpc,
});

See also aws-rds where credentials generation and rotation is integrated.

Changelog

1.28.0 (2020-03-16)

⚠ BREAKING CHANGES TO EXPERIMENTAL FEATURES

• batch: computeEnvironments is now required
• batch: the allocationStrategy property was moved from ComputeEnvironmentProps to the ComputeResources interface, which is where it semantically belongs.
• custom-resources: getDataString was renamed to getResponseField.
• custom-resources: getData was renamed to getResponseFieldReference.
• custom-resources: catchErrorPattern was renamed to ignoreErrorCodesMatching. In addition, a few synth time validations were added when using this property. See Error Handling for details.
• custom-resources: policyStatements property was removed in favor of a required policy property. Refer to Execution Policy for more details.

Features

• amplify: App, Branch and Domain (#5177) (e126048)
• apigateway: authorizationScopes for a Method (#6502) (3887cd2)
• apigateway: DomainName supports SecurityPolicy (#6374) (e8c2e0c)
• apigateway: rate limited API key (#6509) (040906f), closes #6405
• batch: ec2 launch template support (#6602) (2b02693)
• cfnspec: cloudformation spec v11.3.0 (#6598) (ee3a530)
• cli: pass CloudFormation parameters to "cdk deploy" (#6385) (6551124), closes #1237
• core: duration.toHumanString() (#6691) (d833bea)
• custom-resources: enforce user opt-in when auto-generating SDK call policies (0f5c24e), closes #5873
• custom-resources: log retention for AwsCustomResource (#6698) (bf5ab69)
• custom-resources: module is now stable :) (#6584) (a2a738c)
• custom-resources: rename catchErrorPattern to ignoreErrorCodesMatching (#6553) (94599f8), closes #5873
• custom-resources: rename getData* to getResponseField* (#6556) (d5867b4), closes #5873
• dynamodb: expose stream features on ITable (#6635) (52e8b95), closes #6344
• efs: create EFS file systems (#6373) (a0fb518), closes #6286 #6286
• elbv2: support pathpattern array (#6558) (c3ee413), closes #6497
• iam: policy document from json (#6486) (bf08988)
• prlinter: support exempting checks from pr based on a label (#6693) (77cbe80)
• stepfunctions-tasks: run batch job (#6396) (de1a36b), closes #6467
• cloudformation spec v11.4.0 (#6700) (b28b427)

Bug Fixes

• apigateway: type mismatch in C# when setting identitySources (#6649) (2d3e7b1), closes #6538 40aws-cdk/aws-apigateway/test/authorizers/integ.request-authorizer.ts#L26
• batch: computeEnvironments is now required for JobQueue (#6616) (0b6c865), closes #6615
• batch: managed compute environment now properly works with compute resources and instanceRole has correct docstring and type definition (#6549) (4e81334)
• certificatemanager: Route53 endpoint cannot be set and does not work for aws-cn (#6480) (9858cdb)
• cli: codepipeline cloudformation action in cross account fail writing outputArtifacts (#6594) (05cf78b)
• cloudwatch: missing LessThanLowerOrGreaterThanUpperThreshold (#6597) (9731555)
• codepipeline-actions: use IBaseService instead of BaseService in EcsDeployActionProps (#6412) (bed5357)
• eks: cannot upgrade version of clusters with an explicit name (#6064) (1dd7104)
• eks: sporadic broken pipe when deploying helm charts (#6522) (03df1f1), closes #6381
• iam: cannot add multiple conditions using same operator (348a952)