Copy page

AWS

Secrets Manager

Retrieves and monitors secrets information from AWS Secrets Manager.

Sync Type: Full Synchronisation

Details

The AWS Secrets Manager input collects secrets metadata from AWS Secrets Manager. It retrieves secret ARNs, names, descriptions, and related secret information based on the configured filters.

Each sync re-lists every matching secret in the configured region, so the same secrets are emitted again on every run. The input reads secret metadata only; it never reads secret values.

Requirements

• IAM Role Assumption / Static Credentials
• Example permission to attach to the role/user:

Code
{
   "Version": "2012-10-17",
   "Statement": [
      {
         "Sid": "SecretsManagerPermissions",
         "Effect": "Allow",
         "Action": [
            "secretsmanager:ListSecrets"
         ],
         "Resource": "*"
      }
   ]
}

Configuration

Settings

Setting	Type	Required	Default	Description
region	string	Yes	us-east-1	The AWS region to use. Allowed values: us-east-1, us-east-2, us-west-1, us-west-2, af-south-1, ap-east-1, ap-south-1, ap-northeast-1, ap-northeast-2, ap-northeast-3, ap-southeast-1, ap-southeast-2, ca-central-1, ca-west-1, cn-north-1, cn-northwest-1, eu-central-1, eu-west-1, eu-west-2, eu-west-3, eu-north-1, eu-south-1, me-south-1, sa-east-1, us-gov-east-1, us-gov-west-1.
cron	string (cron)	Yes	0 * * * *	Cron string for scheduling the ingest of your input. eg: 0 0 * * * - Daily at midnight, or */15 * * * * - Every 15 minutes. Defaults to an hour.
role_arn	string	No	-	The ARN of the IAM role to assume for accessing AWS resources.
include_planned_deletion	bool	No	-	Whether or not to include secrets scheduled for deletion
filters	array of object	No	[]	Array of filters for the secrets. Multiple filters are combined with AND logic, multiple values within a filter use OR logic.
use_synthetic_data	bool	No	false	Generate synthetic data for testing, instead of connecting to a real data source. Defaults to an hourly cron schedule for cron-based inputs.

Filters

You can filter secrets using the following keys:

Filter Key	Description	Example Values
name	Filter by secret name (prefix match, case-sensitive)	["prod/", "app/database/"]
description	Filter by description (prefix match, not case-sensitive)	["database", "api key"]
tag-key	Filter by tag key (prefix match, case-sensitive)	["Environment", "Team"]
tag-value	Filter by tag value (prefix match, case-sensitive)	["production", "backend"]
primary-region	Filter by primary region (prefix match, case-sensitive)	["us-west-2", "us-east-1"]
owning-service	Filter by owning service (prefix match, case-sensitive)	["rds", "lambda", "ecs"]
all	Search all attributes (not case-sensitive)	["database", "production"]

Note: Prefix filter values with ! for negation (e.g., ["!test/", "!dev/"] to exclude test and dev secrets).

Filter Examples:

Production secrets only:

Code
"filters": [
  {
    "key": "name",
    "values": ["prod/"]
  }
]

Secrets (Static Credentials Only)

Secret	Type	Required	Description
access_key	secret	No	The Access Key from AWS to authenticate with AWS
secret_key	secret	No	The Secret Key from AWS to authenticate with AWS

⚠️ Authentication: Choose either Role ARN (recommended) or static credentials. See AWS Authentication Guide for setup instructions.

Sample Record

Code
{
  "ARN": "arn:aws:secretsmanager:us-east-1:772057037646:secret:prod/api/keys-AbcDef",
  "CreatedDate": "2025-08-11T23:46:57.642505Z",
  "DeletedDate": null,
  "Description": "API keys for the production service",
  "ExternalSecretRotationMetadata": null,
  "ExternalSecretRotationRoleArn": null,
  "KmsKeyId": "arn:aws:kms:us-east-1:772057037646:key/12345678-1234-1234-1234-123456789012",
  "LastAccessedDate": "2025-08-11T00:00:00Z",
  "LastChangedDate": "2025-08-11T23:46:57.642568Z",
  "LastRotatedDate": "2025-08-11T23:46:57.642568Z",
  "Name": "prod/api/keys",
  "NextRotationDate": "2025-09-10T23:59:59Z",
  "OwningService": null,
  "PrimaryRegion": null,
  "RotationEnabled": true,
  "RotationLambdaARN": "arn:aws:lambda:us-east-1:772057037646:function:rotate-api-keys",
  "RotationRules": {
    "AutomaticallyAfterDays": 30,
    "Duration": null,
    "ScheduleExpression": null
  },
  "SecretVersionsToStages": {
    "ed926b69-4b3c-44ef-8f56-385d94e7eed8": [
      "AWSCURRENT"
    ]
  },
  "Tags": [
    {
      "Key": "Environment",
      "Value": "Production"
    }
  ],
  "Type": null
}

Sync frequency

This input runs on a cron schedule (default hourly, 0 * * * *), which you can configure on the pipeline. See Input Sync Frequency for details.