AWS Secrets Manager

AWS Secrets Manager is a secrets management service that helps you protect access to your applications, services, and IT resources. It enables you to rotate, manage, and retrieve database credentials, API keys, and other secrets throughout their lifecycle.

With AWS Secrets Manager, you can:

Securely store secrets: Encrypt secrets at rest using AWS KMS encryption keys
Retrieve secrets programmatically: Access secrets from your applications and workflows without hardcoding credentials
Rotate secrets automatically: Configure automatic rotation for supported services like RDS, Redshift, and DocumentDB
Audit access: Track secret access and changes through AWS CloudTrail integration
Control access with IAM: Use fine-grained IAM policies to manage who can access which secrets
Replicate across regions: Automatically replicate secrets to multiple AWS regions for disaster recovery

In Zoen, the AWS Secrets Manager integration allows your workflows to securely retrieve credentials and configuration values at runtime, create and manage secrets as part of automation pipelines, and maintain a centralized secrets store that your agents can access. This is particularly useful for workflows that need to authenticate with external services, rotate credentials, or manage sensitive configuration across environments — all without exposing secrets in your workflow definitions.

Parameter	Type	Required	Description
`region`	string	Yes	AWS region (e.g., us-east-1)
`accessKeyId`	string	Yes	AWS access key ID
`secretAccessKey`	string	Yes	AWS secret access key
`secretId`	string	Yes	The name or ARN of the secret to retrieve
`versionId`	string	No	The unique identifier of the version to retrieve
`versionStage`	string	No	The staging label of the version to retrieve (e.g., AWSCURRENT, AWSPREVIOUS)

Output

Parameter	Type	Description
`name`	string	Name of the secret
`secretValue`	string	The decrypted secret value
`arn`	string	ARN of the secret
`versionId`	string	Version ID of the secret
`versionStages`	array	Staging labels attached to this version
`createdDate`	string	Date the secret was created

`secrets_manager_list_secrets`

List secrets stored in AWS Secrets Manager

Input

Parameter	Type	Required	Description
`region`	string	Yes	AWS region (e.g., us-east-1)
`accessKeyId`	string	Yes	AWS access key ID
`secretAccessKey`	string	Yes	AWS secret access key
`maxResults`	number	No	Maximum number of secrets to return (1-100, default 100)
`nextToken`	string	No	Pagination token from a previous request

Output

Parameter	Type	Description
`secrets`	json	List of secrets with name, ARN, description, dates, rotation rules/window, and version-to-stage mappings
`nextToken`	string	Pagination token for the next page of results
`count`	number	Number of secrets returned

`secrets_manager_create_secret`

Create a new secret in AWS Secrets Manager

Input

Parameter	Type	Required	Description
`region`	string	Yes	AWS region (e.g., us-east-1)
`accessKeyId`	string	Yes	AWS access key ID
`secretAccessKey`	string	Yes	AWS secret access key
`name`	string	Yes	Name of the secret to create
`secretValue`	string	Yes	The secret value (plain text or JSON string)
`description`	string	No	Description of the secret

Output

Parameter	Type	Description
`message`	string	Operation status message
`name`	string	Name of the created secret
`arn`	string	ARN of the created secret
`versionId`	string	Version ID of the created secret

`secrets_manager_update_secret`

Update the value of an existing secret in AWS Secrets Manager

Input

Parameter	Type	Required	Description
`region`	string	Yes	AWS region (e.g., us-east-1)
`accessKeyId`	string	Yes	AWS access key ID
`secretAccessKey`	string	Yes	AWS secret access key
`secretId`	string	Yes	The name or ARN of the secret to update
`secretValue`	string	Yes	The new secret value (plain text or JSON string)
`description`	string	No	Updated description of the secret

Output

Parameter	Type	Description
`message`	string	Operation status message
`name`	string	Name of the updated secret
`arn`	string	ARN of the updated secret
`versionId`	string	Version ID of the updated secret

`secrets_manager_delete_secret`

Delete a secret from AWS Secrets Manager

Input

Parameter	Type	Required	Description
`region`	string	Yes	AWS region (e.g., us-east-1)
`accessKeyId`	string	Yes	AWS access key ID
`secretAccessKey`	string	Yes	AWS secret access key
`secretId`	string	Yes	The name or ARN of the secret to delete
`recoveryWindowInDays`	number	No	Number of days before permanent deletion (7-30, default 30)
`forceDelete`	boolean	No	If true, immediately delete without recovery window

Output

Parameter	Type	Description
`message`	string	Operation status message
`name`	string	Name of the deleted secret
`arn`	string	ARN of the deleted secret
`deletionDate`	string	Scheduled deletion date

`secrets_manager_describe_secret`

Retrieve full metadata for a secret in AWS Secrets Manager, including rotation configuration and replication status, without exposing the secret value

Input

Parameter	Type	Required	Description
`region`	string	Yes	AWS region (e.g., us-east-1)
`accessKeyId`	string	Yes	AWS access key ID
`secretAccessKey`	string	Yes	AWS secret access key
`secretId`	string	Yes	The name or ARN of the secret to describe

Output

Parameter	Type	Description
`name`	string	Name of the secret
`arn`	string	ARN of the secret
`description`	string	Description of the secret
`kmsKeyId`	string	KMS key ID used to encrypt the secret
`rotationEnabled`	boolean	Whether automatic rotation is enabled
`rotationLambdaARN`	string	ARN of the Lambda function used for rotation
`rotationRules`	json	Rotation schedule configuration
`lastRotatedDate`	string	Date the secret was last rotated
`lastChangedDate`	string	Date the secret was last changed
`lastAccessedDate`	string	Date the secret was last accessed
`deletedDate`	string	Scheduled deletion date
`nextRotationDate`	string	Date the secret is next scheduled to rotate
`tags`	array	Tags attached to the secret
`versionIdsToStages`	json	Map of version IDs to their staging labels
`owningService`	string	ID of the AWS service that manages this secret, if any
`createdDate`	string	Date the secret was created
`primaryRegion`	string	The primary region of the secret, if replicated
`replicationStatus`	array	Replication status for each region the secret is replicated to

`secrets_manager_tag_resource`

Attach tags to a secret in AWS Secrets Manager

Input

Parameter	Type	Required	Description
`region`	string	Yes	AWS region (e.g., us-east-1)
`accessKeyId`	string	Yes	AWS access key ID
`secretAccessKey`	string	Yes	AWS secret access key
`secretId`	string	Yes	The name or ARN of the secret to tag
`tags`	json	Yes	Tags to attach, as an array of {key, value} pairs (max 50)

Output

Parameter	Type	Description
`message`	string	Operation status message
`name`	string	Name or ARN of the tagged secret

`secrets_manager_untag_resource`

Remove tags from a secret in AWS Secrets Manager

Input

Parameter	Type	Required	Description
`region`	string	Yes	AWS region (e.g., us-east-1)
`accessKeyId`	string	Yes	AWS access key ID
`secretAccessKey`	string	Yes	AWS secret access key
`secretId`	string	Yes	The name or ARN of the secret to untag
`tagKeys`	json	Yes	Tag keys to remove, as an array of strings (max 50)

Output

Parameter	Type	Description
`message`	string	Operation status message
`name`	string	Name or ARN of the untagged secret

`secrets_manager_restore_secret`

Cancel a scheduled deletion for a secret in AWS Secrets Manager, restoring access to it

Input

Parameter	Type	Required	Description
`region`	string	Yes	AWS region (e.g., us-east-1)
`accessKeyId`	string	Yes	AWS access key ID
`secretAccessKey`	string	Yes	AWS secret access key
`secretId`	string	Yes	The name or ARN of the secret to restore

Output

Parameter	Type	Description
`message`	string	Operation status message
`name`	string	Name of the restored secret
`arn`	string	ARN of the restored secret

`secrets_manager_rotate_secret`

Start or reconfigure rotation for a secret in AWS Secrets Manager

Input

Parameter	Type	Required	Description
`region`	string	Yes	AWS region (e.g., us-east-1)
`accessKeyId`	string	Yes	AWS access key ID
`secretAccessKey`	string	Yes	AWS secret access key
`secretId`	string	Yes	The name or ARN of the secret to rotate
`clientRequestToken`	string	No	Idempotency token for the new secret version (32-64 characters)
`rotationLambdaARN`	string	No	ARN of the Lambda function that performs rotation (omit for managed rotation)
`automaticallyAfterDays`	number	No	Number of days between rotations (1-1000). Mutually exclusive with schedule expression
`duration`	string	No	Length of the rotation window in hours, e.g. "3h"
`scheduleExpression`	string	No	A cron() or rate() expression defining the rotation schedule
`rotateImmediately`	boolean	No	Whether to rotate immediately (default true) or wait for the next scheduled window

Output

Parameter	Type	Description
`message`	string	Operation status message
`name`	string	Name of the secret
`arn`	string	ARN of the secret
`versionId`	string	ID of the new secret version created by rotation

AWS Secrets Manager

Usage Instructions

Actions

`secrets_manager_get_secret`

Input

Output

`secrets_manager_list_secrets`

Input

Output

`secrets_manager_create_secret`

Input

Output

`secrets_manager_update_secret`

Input

Output

`secrets_manager_delete_secret`

Input

Output

`secrets_manager_describe_secret`

Input

Output

`secrets_manager_tag_resource`

Input

Output

`secrets_manager_untag_resource`

Input

Output

`secrets_manager_restore_secret`

Input

Output

`secrets_manager_rotate_secret`

Input

Output

On this page