AWS Secrets Manager

AWS Secrets Manager é um serviço de gerenciamento de segredos que ajuda a proteger o acesso às suas aplicações, serviços e recursos de TI. Ele permite rotacionar, gerenciar e recuperar credenciais de banco de dados, chaves de API e outros segredos ao longo do seu ciclo de vida.

Com o AWS Secrets Manager, você pode:

Armazenar segredos com segurança: Criptografe segredos em repouso usando chaves de criptografia AWS KMS
Recuperar segredos programaticamente: Acesse segredos das suas aplicações e workflows sem hardcoding de credenciais
Rotacionar segredos automaticamente: Configure a rotação automática para serviços suportados como RDS, Redshift e DocumentDB
Auditar o acesso: Rastreie o acesso e as alterações de segredos por meio da integração com o AWS CloudTrail
Controlar o acesso com IAM: Use políticas IAM refinadas para gerenciar quem pode acessar quais segredos
Replicar entre regiões: Replique automaticamente segredos para várias regiões AWS para recuperação de desastres

No Zoen, a integração com o AWS Secrets Manager permite que seus workflows recuperem com segurança credenciais e valores de configuração em tempo de execução, criem e gerenciem segredos como parte de pipelines de automação, e mantenham um repositório centralizado de segredos que seus agentes podem acessar. Isso é particularmente útil para workflows que precisam autenticar com serviços externos, rotacionar credenciais ou gerenciar configuração sensível entre ambientes — tudo sem expor segredos nas definições do seu workflow.

Parameter	Type	Required	Description
`region`	string	Yes	AWS region (e.g., us-east-1)
`accessKeyId`	string	Yes	AWS access key ID
`secretAccessKey`	string	Yes	AWS secret access key
`secretId`	string	Yes	The name or ARN of the secret to retrieve
`versionId`	string	No	The unique identifier of the version to retrieve
`versionStage`	string	No	The staging label of the version to retrieve (e.g., AWSCURRENT, AWSPREVIOUS)

Output

Parameter	Type	Description
`name`	string	Name of the secret
`secretValue`	string	The decrypted secret value
`arn`	string	ARN of the secret
`versionId`	string	Version ID of the secret
`versionStages`	array	Staging labels attached to this version
`createdDate`	string	Date the secret was created

`secrets_manager_list_secrets`

List secrets stored in AWS Secrets Manager

Input

Parameter	Type	Required	Description
`region`	string	Yes	AWS region (e.g., us-east-1)
`accessKeyId`	string	Yes	AWS access key ID
`secretAccessKey`	string	Yes	AWS secret access key
`maxResults`	number	No	Maximum number of secrets to return (1-100, default 100)
`nextToken`	string	No	Pagination token from a previous request

Output

Parameter	Type	Description
`secrets`	json	List of secrets with name, ARN, description, dates, rotation rules/window, and version-to-stage mappings
`nextToken`	string	Pagination token for the next page of results
`count`	number	Number of secrets returned

`secrets_manager_create_secret`

Create a new secret in AWS Secrets Manager

Input

Parameter	Type	Required	Description
`region`	string	Yes	AWS region (e.g., us-east-1)
`accessKeyId`	string	Yes	AWS access key ID
`secretAccessKey`	string	Yes	AWS secret access key
`name`	string	Yes	Name of the secret to create
`secretValue`	string	Yes	The secret value (plain text or JSON string)
`description`	string	No	Description of the secret

Output

Parameter	Type	Description
`message`	string	Operation status message
`name`	string	Name of the created secret
`arn`	string	ARN of the created secret
`versionId`	string	Version ID of the created secret

`secrets_manager_update_secret`

Update the value of an existing secret in AWS Secrets Manager

Input

Parameter	Type	Required	Description
`region`	string	Yes	AWS region (e.g., us-east-1)
`accessKeyId`	string	Yes	AWS access key ID
`secretAccessKey`	string	Yes	AWS secret access key
`secretId`	string	Yes	The name or ARN of the secret to update
`secretValue`	string	Yes	The new secret value (plain text or JSON string)
`description`	string	No	Updated description of the secret

Output

Parameter	Type	Description
`message`	string	Operation status message
`name`	string	Name of the updated secret
`arn`	string	ARN of the updated secret
`versionId`	string	Version ID of the updated secret

`secrets_manager_delete_secret`

Delete a secret from AWS Secrets Manager

Input

Parameter	Type	Required	Description
`region`	string	Yes	AWS region (e.g., us-east-1)
`accessKeyId`	string	Yes	AWS access key ID
`secretAccessKey`	string	Yes	AWS secret access key
`secretId`	string	Yes	The name or ARN of the secret to delete
`recoveryWindowInDays`	number	No	Number of days before permanent deletion (7-30, default 30)
`forceDelete`	boolean	No	If true, immediately delete without recovery window

Output

Parameter	Type	Description
`message`	string	Operation status message
`name`	string	Name of the deleted secret
`arn`	string	ARN of the deleted secret
`deletionDate`	string	Scheduled deletion date

`secrets_manager_describe_secret`

Retrieve full metadata for a secret in AWS Secrets Manager, including rotation configuration and replication status, without exposing the secret value

Input

Parameter	Type	Required	Description
`region`	string	Yes	AWS region (e.g., us-east-1)
`accessKeyId`	string	Yes	AWS access key ID
`secretAccessKey`	string	Yes	AWS secret access key
`secretId`	string	Yes	The name or ARN of the secret to describe

Output

Parameter	Type	Description
`name`	string	Name of the secret
`arn`	string	ARN of the secret
`description`	string	Description of the secret
`kmsKeyId`	string	KMS key ID used to encrypt the secret
`rotationEnabled`	boolean	Whether automatic rotation is enabled
`rotationLambdaARN`	string	ARN of the Lambda function used for rotation
`rotationRules`	json	Rotation schedule configuration
`lastRotatedDate`	string	Date the secret was last rotated
`lastChangedDate`	string	Date the secret was last changed
`lastAccessedDate`	string	Date the secret was last accessed
`deletedDate`	string	Scheduled deletion date
`nextRotationDate`	string	Date the secret is next scheduled to rotate
`tags`	array	Tags attached to the secret
`versionIdsToStages`	json	Map of version IDs to their staging labels
`owningService`	string	ID of the AWS service that manages this secret, if any
`createdDate`	string	Date the secret was created
`primaryRegion`	string	The primary region of the secret, if replicated
`replicationStatus`	array	Replication status for each region the secret is replicated to

`secrets_manager_tag_resource`

Attach tags to a secret in AWS Secrets Manager

Input

Parameter	Type	Required	Description
`region`	string	Yes	AWS region (e.g., us-east-1)
`accessKeyId`	string	Yes	AWS access key ID
`secretAccessKey`	string	Yes	AWS secret access key
`secretId`	string	Yes	The name or ARN of the secret to tag
`tags`	json	Yes	Tags to attach, as an array of {key, value} pairs (max 50)

Output

Parameter	Type	Description
`message`	string	Operation status message
`name`	string	Name or ARN of the tagged secret

`secrets_manager_untag_resource`

Remove tags from a secret in AWS Secrets Manager

Input

Parameter	Type	Required	Description
`region`	string	Yes	AWS region (e.g., us-east-1)
`accessKeyId`	string	Yes	AWS access key ID
`secretAccessKey`	string	Yes	AWS secret access key
`secretId`	string	Yes	The name or ARN of the secret to untag
`tagKeys`	json	Yes	Tag keys to remove, as an array of strings (max 50)

Output

Parameter	Type	Description
`message`	string	Operation status message
`name`	string	Name or ARN of the untagged secret

`secrets_manager_restore_secret`

Cancel a scheduled deletion for a secret in AWS Secrets Manager, restoring access to it

Input

Parameter	Type	Required	Description
`region`	string	Yes	AWS region (e.g., us-east-1)
`accessKeyId`	string	Yes	AWS access key ID
`secretAccessKey`	string	Yes	AWS secret access key
`secretId`	string	Yes	The name or ARN of the secret to restore

Output

Parameter	Type	Description
`message`	string	Operation status message
`name`	string	Name of the restored secret
`arn`	string	ARN of the restored secret

`secrets_manager_rotate_secret`

Start or reconfigure rotation for a secret in AWS Secrets Manager

Input

Parameter	Type	Required	Description
`region`	string	Yes	AWS region (e.g., us-east-1)
`accessKeyId`	string	Yes	AWS access key ID
`secretAccessKey`	string	Yes	AWS secret access key
`secretId`	string	Yes	The name or ARN of the secret to rotate
`clientRequestToken`	string	No	Idempotency token for the new secret version (32-64 characters)
`rotationLambdaARN`	string	No	ARN of the Lambda function that performs rotation (omit for managed rotation)
`automaticallyAfterDays`	number	No	Number of days between rotations (1-1000). Mutually exclusive with schedule expression
`duration`	string	No	Length of the rotation window in hours, e.g. "3h"
`scheduleExpression`	string	No	A cron() or rate() expression defining the rotation schedule
`rotateImmediately`	boolean	No	Whether to rotate immediately (default true) or wait for the next scheduled window

Output

Parameter	Type	Description
`message`	string	Operation status message
`name`	string	Name of the secret
`arn`	string	ARN of the secret
`versionId`	string	ID of the new secret version created by rotation

AWS Secrets Manager

Usage Instructions

Actions

`secrets_manager_get_secret`

Input

Output

`secrets_manager_list_secrets`

Input

Output

`secrets_manager_create_secret`

Input

Output

`secrets_manager_update_secret`

Input

Output

`secrets_manager_delete_secret`

Input

Output

`secrets_manager_describe_secret`

Input

Output

`secrets_manager_tag_resource`

Input

Output

`secrets_manager_untag_resource`

Input

Output

`secrets_manager_restore_secret`

Input

Output

`secrets_manager_rotate_secret`

Input

Output

On this page