Aws/secretsmanager
@swamp/aws/secretsmanagerv2026.10.13.1
01README
AWS SECRETSMANAGER infrastructure models
02Release Notes
- Updated: resource_policy, rotation_schedule, secret, secret_target_attachment
03Behaviors
@swamp/aws/secretsmanager/resource-policyv2026.10.13.1resource_policy.ts
Global Arguments
| Argument | Type | Description |
|---|---|---|
| name | string | Instance name for this resource (used as the unique identifier in the factory pattern) |
| accessKeyId? | string | AWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault. |
| secretAccessKey? | string | AWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault. |
| sessionToken? | string | AWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault. |
| region? | string | AWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1. |
| SecretId | string | The ARN or name of the secret to attach the resource-based policy. |
| ResourcePolicy | record | A JSON-formatted string for an AWS resource-based policy. |
| BlockPublicPolicy? | boolean | Specifies whether to block resource-based policies that allow broad access to the secret. |
fn create()
Create a SecretsManager ResourcePolicy
fn get(identifier: string)
Get a SecretsManager ResourcePolicy
| Argument | Type | Description |
|---|---|---|
| identifier | string | The primary identifier of the SecretsManager ResourcePolicy |
fn update()
Update a SecretsManager ResourcePolicy
fn delete(identifier: string)
Delete a SecretsManager ResourcePolicy
| Argument | Type | Description |
|---|---|---|
| identifier | string | The primary identifier of the SecretsManager ResourcePolicy |
fn sync()
Sync SecretsManager ResourcePolicy state from AWS
fn list(maxPages?: number, resourceModel?: string)
List SecretsManager ResourcePolicy resources
| Argument | Type | Description |
|---|---|---|
| maxPages? | number | Maximum number of pages to fetch (default: 10) |
| resourceModel? | string | JSON resource model for parent-scoped listing (e.g. parent identifier) |
Resources
state(infinite)— SecretsManager ResourcePolicy resource state
@swamp/aws/secretsmanager/rotation-schedulev2026.10.13.1rotation_schedule.ts
Global Arguments
| Argument | Type | Description |
|---|---|---|
| name | string | Instance name for this resource (used as the unique identifier in the factory pattern) |
| accessKeyId? | string | AWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault. |
| secretAccessKey? | string | AWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault. |
| sessionToken? | string | AWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault. |
| region? | string | AWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1. |
| HostedRotationLambda? | object | Creates a new Lambda rotation function based on one of the Secrets Manager rotation function templates. To use a rotation function that already exists, specify RotationLambdaARN instead. |
| SecretId | string | The ARN or name of the secret to rotate. |
| ExternalSecretRotationMetadata? | array | The list of metadata needed to successfully rotate a managed external secret. |
| ExternalSecretRotationRoleArn? | string | The ARN of the IAM role that is used by Secrets Manager to rotate a managed external secret. |
| RotateImmediatelyOnUpdate? | boolean | Specifies whether to rotate the secret immediately or wait until the next scheduled rotation window. |
| RotationLambdaARN? | string | The ARN of an existing Lambda rotation function. To specify a rotation function that is also defined in this template, use the Ref function. |
| RotationRules? | object | A structure that defines the rotation configuration for this secret. |
fn create()
Create a SecretsManager RotationSchedule
fn get(identifier: string)
Get a SecretsManager RotationSchedule
| Argument | Type | Description |
|---|---|---|
| identifier | string | The primary identifier of the SecretsManager RotationSchedule |
fn update()
Update a SecretsManager RotationSchedule
fn delete(identifier: string)
Delete a SecretsManager RotationSchedule
| Argument | Type | Description |
|---|---|---|
| identifier | string | The primary identifier of the SecretsManager RotationSchedule |
fn sync()
Sync SecretsManager RotationSchedule state from AWS
fn list(maxPages?: number, resourceModel?: string)
List SecretsManager RotationSchedule resources
| Argument | Type | Description |
|---|---|---|
| maxPages? | number | Maximum number of pages to fetch (default: 10) |
| resourceModel? | string | JSON resource model for parent-scoped listing (e.g. parent identifier) |
Resources
state(infinite)— SecretsManager RotationSchedule resource state
@swamp/aws/secretsmanager/secretv2026.10.13.1secret.ts
Global Arguments
| Argument | Type | Description |
|---|---|---|
| name | string | Instance name for this resource (used as the unique identifier in the factory pattern) |
| accessKeyId? | string | AWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault. |
| secretAccessKey? | string | AWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault. |
| sessionToken? | string | AWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault. |
| region? | string | AWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1. |
| Description? | string | The description of the secret. |
| KmsKeyId? | string | The ARN, key ID, or alias of the KMS key that Secrets Manager uses to encrypt the secret value in the secret. An alias is always prefixed by alias/, for example alias/aws/secretsmanager. For more information, see [About aliases](https://docs.aws.amazon.com/kms/latest/developerguide/alias-about.html). To use a KMS key in a different account, use the key ARN or the alias ARN. If you don't specify this value, then Secrets Manager uses the key aws/secretsmanager. If that key doesn't yet exist, then |
| SecretString? | string | The text to encrypt and store in the secret. We recommend you use a JSON structure of key/value pairs for your secret value. To generate a random password, use GenerateSecretString instead. If you omit both GenerateSecretString and SecretString, you create an empty secret. When you make a change to this property, a new secret version is created. |
| GenerateSecretString? | object | A structure that specifies how to generate a password to encrypt and store in the secret. To include a specific string in the secret, use SecretString instead. If you omit both GenerateSecretString and SecretString, you create an empty secret. When you make a change to this property, a new secret version is created. We recommend that you specify the maximum length and include every character type that the system you are generating a password for can support. |
| ReplicaRegions? | array | A custom type that specifies a Region and the KmsKeyId for a replica secret. |
| Tags? | array | A list of tags to attach to the secret. Each tag is a key and value pair of strings in a JSON text string, for example: [{"Key":"CostCenter","Value":"12345"},{"Key":"environment","Value":"production"}] Secrets Manager tag key names are case sensitive. A tag with the key "ABC" is a different tag from one with key "abc". Stack-level tags, tags you apply to the CloudFormation stack, are also attached to the secret. If you check tags in permissions policies as part of your security strategy, then ad |
| Name? | string | The name of the new secret. The secret name can contain ASCII letters, numbers, and the following characters: /_+=.@- Do not end your secret name with a hyphen followed by six characters. If you do so, you risk confusion and unexpected results when searching for a secret by partial ARN. Secrets Manager automatically adds a hyphen and six random characters after the secret name at the end of the ARN. |
| Type? | string | The exact string that identifies the third-party partner that holds the external secret. For more information, see [Managed external secret partners](https://docs.aws.amazon.com/secretsmanager/latest/userguide/mes-partners.html). |
fn create()
Create a SecretsManager Secret
fn get(identifier: string)
Get a SecretsManager Secret
| Argument | Type | Description |
|---|---|---|
| identifier | string | The primary identifier of the SecretsManager Secret |
fn update()
Update a SecretsManager Secret
fn delete(identifier: string)
Delete a SecretsManager Secret
| Argument | Type | Description |
|---|---|---|
| identifier | string | The primary identifier of the SecretsManager Secret |
fn sync()
Sync SecretsManager Secret state from AWS
fn list(maxPages?: number, resourceModel?: string)
List SecretsManager Secret resources
| Argument | Type | Description |
|---|---|---|
| maxPages? | number | Maximum number of pages to fetch (default: 10) |
| resourceModel? | string | JSON resource model for parent-scoped listing (e.g. parent identifier) |
Resources
state(infinite)— SecretsManager Secret resource state
@swamp/aws/secretsmanager/secret-target-attachmentv2026.10.13.1secret_target_attachment.ts
Global Arguments
| Argument | Type | Description |
|---|---|---|
| name | string | Instance name for this resource (used as the unique identifier in the factory pattern) |
| accessKeyId? | string | AWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault. |
| secretAccessKey? | string | AWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault. |
| sessionToken? | string | AWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault. |
| region? | string | AWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1. |
| SecretId | string | |
| TargetType | string | |
| TargetId | string |
fn create()
Create a SecretsManager SecretTargetAttachment
fn get(identifier: string)
Get a SecretsManager SecretTargetAttachment
| Argument | Type | Description |
|---|---|---|
| identifier | string | The primary identifier of the SecretsManager SecretTargetAttachment |
fn update()
Update a SecretsManager SecretTargetAttachment
fn delete(identifier: string)
Delete a SecretsManager SecretTargetAttachment
| Argument | Type | Description |
|---|---|---|
| identifier | string | The primary identifier of the SecretsManager SecretTargetAttachment |
fn sync()
Sync SecretsManager SecretTargetAttachment state from AWS
fn list(maxPages?: number, resourceModel?: string)
List SecretsManager SecretTargetAttachment resources
| Argument | Type | Description |
|---|---|---|
| maxPages? | number | Maximum number of pages to fetch (default: 10) |
| resourceModel? | string | JSON resource model for parent-scoped listing (e.g. parent identifier) |
Resources
state(infinite)— SecretsManager SecretTargetAttachment resource state
04Previous Versions
2026.10.08.1
2026.10.06.1
2026.10.04.1
2026.10.03.1
2026.10.02.1
2026.10.01.1
2026.09.30.1
2026.09.29.1
2026.09.28.1
2026.09.27.1
2026.09.26.1
2026.09.25.1
2026.09.24.1
2026.09.23.1
2026.09.21.1
2026.09.20.1
2026.09.19.1
2026.09.18.1
2026.09.17.1
05Stats
A
93 / 100
Downloads
896
Archive size
822.1 KB
Verified by Swamp
- Has README or module doc2/2earned
- README has a code example1/1earned
- README is substantive1/1earned
- Most symbols documented1/1earned
- No slow types (deprecated)1/1earned
- Dependencies pass trust audit2/2earned
- Has description1/1earned
- Platform support declared (or universal)2/2earned
- License1/2partial
no SPDX license declared
- Verified public repository2/2earned
06Platforms
07Labels