AwsSecretsManagerSecretArgs

interface AwsSecretsManagerSecretArgs extends Omit<aws.secretsmanager.SecretArgs, 'name' | 'policy' | 'kmsKeyId'> {
description?: Input<string | undefined>;
forceOverwriteReplicaSecret?: Input<boolean | undefined>;
kmsKey?: AwsKmsKeyInput;
name: string;
namePrefix?: Input<string | undefined>;
policy?: AwsSecretsManagerPolicyDocumentTemplate;
recoveryWindowInDays?: Input<number | undefined>;
region?: Input<string | undefined>;
replicas?: Input<Input<SecretReplica>[] | undefined>;
secretBinary?: Input<string>;
secretString?: Input<string>;
tags?: Input<{ [key: string]: Input<string> } | undefined>;
type?: Input<string | undefined>;
valueFromOnePassword?: ResolveOnePasswordValueArgs;
}

Input arguments for AwsSecretsManagerSecret.

Remarks

This type maps directly to aws.secretsmanager.SecretArgs with two changes:

policy accepts a JSON file/template input with {{ variable }} substitution.
kmsKey accepts a canonical KMS key reference. When omitted, AWS uses the account's aws/secretsmanager AWS-managed key — the secret is still encrypted but key policy and rotation cannot be controlled via CMK.

Example

CODE

const args: AwsSecretsManagerSecretArgs = {
  description: 'Database credentials for the application',
  kmsKey,
  policy: {
    path: './policies/secret-resource-policy.json',
  },
};

Hierarchy

SecretArgs, "name" | "policy" | "kmsKeyId">
AwsSecretsManagerSecretArgs

Properties

`description: Input<string | undefined>`

Inherited from description

Description of the secret.

`forceOverwriteReplicaSecret: Input<boolean | undefined>`

Inherited from forceOverwriteReplicaSecret

Accepts boolean value to specify whether to overwrite a secret with the same name in the destination Region.

`kmsKey: AwsKmsKeyInput`

Optional KMS key for encrypting secret values.

Remarks

Use keyArn for a known ARN or identifier for a key ID, key ARN, alias, or alias ARN. When omitted, AWS uses aws/secretsmanager (AWS-managed key).

`name: string`

Required synchronous plain-string secret purpose name used in the AWS naming pattern.

Remarks

This value is also used as the Pulumi logical identity source when creating the secret through AwsSecretsManager. pulumi.Output, promises, and other asynchronous values are not accepted.

`namePrefix: Input<string | undefined>`

Inherited from namePrefix

Creates a unique name beginning with the specified prefix. Conflicts with name.

`policy: AwsSecretsManagerPolicyDocumentTemplate`

Optional JSON file/template input for the inline resource policy.

Remarks

The file must contain valid JSON after applying optional {{ variable }} substitutions. Set to undefined to omit the inline policy. Use AwsSecretsManagerSecretPolicy to manage the resource policy as a separate lifecycle resource instead.

`recoveryWindowInDays: Input<number | undefined>`

Inherited from recoveryWindowInDays

Number of days that AWS Secrets Manager waits before it can delete the secret. This value can be 0 to force deletion without recovery or range from 7 to 30 days. The default value is 30.

`region: Input<string | undefined>`

Inherited from region

Region where this resource will be managed. Defaults to the Region set in the provider configuration.

`replicas: Input<Input<SecretReplica>[] | undefined>`

Inherited from replicas

Configuration block to support secret replication. See details below.

`secretBinary: Input<string>`

Optional base64-encoded secret binary value written as a separate secret version.

Remarks

Mutually exclusive with secretString and valueFromOnePassword.

`secretString: Input<string>`

Optional direct secret string value written as a separate secret version.

Remarks

Mutually exclusive with secretBinary and valueFromOnePassword.

`tags: Input<{ [key: string]: Input<string> } | undefined>`

Inherited from tags

Key-value map of user-defined tags that are attached to the secret. If configured with a provider defaultTags configuration block present, tags with matching keys will overwrite those defined at the provider-level.

`type: Input<string | undefined>`

Inherited from type

The type of secret for managed external secrets. Valid values are SalesforceClientSecret, BigIDClientSecret, and SnowflakeKeyPairAuthentication. For more information about supported partners and their specific requirements, see Managed external secret partners. This attribute cannot be changed after creation.

`valueFromOnePassword: ResolveOnePasswordValueArgs`

Optional 1Password source used to resolve a secret string during deployment.

Remarks

Mutually exclusive with secretString and secretBinary. title resolves the exact supplied title. titleWithPattern resolves ${stack}-secretsManager-<secretNameInCamelCase>.