Skip to main content

PIN A SECRETS MANAGER VAULT TO A NAMED AWS PROFILE

This guide shows you how to set up an @swamp/aws-sm vault that always authenticates as one named AWS profile, how to store a secret in it, and how to reference that secret from behaviors.

Prerequisites

  • A Swamp repository, and swamp auth login completed
  • A named profile, here platform-admin, defined in ~/.aws/config or ~/.aws/credentials. Profiles that assume a role and SSO profiles both work. credential_process profiles may not work. For SSO, see Authenticate to AWS with SSO.
  • The profile must have the IAM permissions listed on the @swamp/aws-sm registry page

Pull the vault extension

swamp extension pull @swamp/aws-sm

The output looks like:

INF extension·pull: Pulling "@swamp/aws-sm"@"2026.10.13.1"
INF extension·pull: Identity verified: "@swamp/aws-sm"@"2026.10.13.1"
INF extension·pull: Pulled "@swamp/aws-sm"@"2026.10.13.1"
INF extension·pull: Extracted 8 files:

Create the vault with a profile

Create a vault of type @swamp/aws-sm named app-secrets with swamp vault create, as shown in Use AWS Secrets Manager. In the --config JSON, set region to the region that holds your secrets, here us-east-1. Then add a profile key set to platform-admin.

When a profile is configured, it takes precedence over AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY in the environment. If you leave out profile, the vault uses the default AWS credential chain.

Store a secret

swamp vault put app-secrets myapp/production/api-key replace-with-real-value

This command uses the platform-admin profile's credentials to write the value to Secrets Manager in us-east-1, as a secret named myapp/production/api-key.

Confirm the secret exists

swamp vault list-keys app-secrets

This command lists the Secrets Manager secret names the profile can see. The list should include myapp/production/api-key.

Reference the secret from a behavior

In any behavior global argument that needs the value, use ${{ vault.get('app-secrets', 'myapp/production/api-key') }} instead of the value itself. Swamp resolves the expression when the behavior runs.

See the Vaults reference for annotations, inspection and the full list of vault commands.