software.amazon.awscdk.services.secretsmanager

Interface SecretProps

All Superinterfaces:

software.amazon.jsii.JsiiSerializable

All Known Implementing Classes:

SecretProps.Jsii$Proxy

@Generated(value="jsii-pacmak/1.67.0 (build 2c027f5)",
           date="2022-09-19T20:26:42.054Z")
 @Stability(value=Stable)
public interface SecretProps
extends software.amazon.jsii.JsiiSerializable

The properties required to create a new secret in AWS Secrets Manager.

Example:

 Stack stack;
 User user = new User(stack, "User");
 AccessKey accessKey = AccessKey.Builder.create(stack, "AccessKey").user(user).build();
 Secret.Builder.create(stack, "Secret")
         .secretObjectValue(Map.of(
                 "username", SecretValue.unsafePlainText(user.getUserName()),
                 "database", SecretValue.unsafePlainText("foo"),
                 "password", accessKey.getSecretAccessKey()))
         .build();
 

Nested Class Summary

Nested Classes

Modifier and Type	Interface and Description
static class	SecretProps.Builder A builder for SecretProps
static class	SecretProps.Jsii$Proxy An implementation for SecretProps

Method Summary

Modifier and Type	Method and Description
static SecretProps.Builder	builder()
default String	getDescription() An optional, human-friendly description of the secret.
default IKey	getEncryptionKey() The customer-managed encryption key to use for encrypting the secret value.
default SecretStringGenerator	getGenerateSecretString() Configuration for how to generate a secret value.
default RemovalPolicy	getRemovalPolicy() Policy to apply when the secret is removed from this stack.
default List<ReplicaRegion>	getReplicaRegions() A list of regions where to replicate this secret.
default String	getSecretName() A name for the secret.
default Map<String,SecretValue>	getSecretObjectValue() Initial value for a JSON secret.
default SecretStringValueBeta1	getSecretStringBeta1() Deprecated. Use `secretStringValue` instead.
default SecretValue	getSecretStringValue() Initial value for the secret.

Methods inherited from interface software.amazon.jsii.JsiiSerializable

$jsii$toJson

Method Detail

getDescription

@Stability(value=Stable)
 @Nullable
default String getDescription()

An optional, human-friendly description of the secret.

Default: - No description.

getEncryptionKey

@Stability(value=Stable)
 @Nullable
default IKey getEncryptionKey()

The customer-managed encryption key to use for encrypting the secret value.

Default: - A default KMS key for the account and region is used.

getGenerateSecretString

@Stability(value=Stable)
 @Nullable
default SecretStringGenerator getGenerateSecretString()

Configuration for how to generate a secret value.

Only one of secretString and generateSecretString can be provided.

Default: - 32 characters with upper-case letters, lower-case letters, punctuation and numbers (at least one from each category), per the default values of ``SecretStringGenerator``.

getRemovalPolicy

@Stability(value=Stable)
 @Nullable
default RemovalPolicy getRemovalPolicy()

Policy to apply when the secret is removed from this stack.

Default: - Not set.

getReplicaRegions

@Stability(value=Stable)
 @Nullable
default List<ReplicaRegion> getReplicaRegions()

A list of regions where to replicate this secret.

Default: - Secret is not replicated

getSecretName

@Stability(value=Stable)
 @Nullable
default String getSecretName()

A name for the secret.

Note that deleting secrets from SecretsManager does not happen immediately, but after a 7 to 30 days blackout period. During that period, it is not possible to create another secret that shares the same name.

Default: - A name is generated by CloudFormation.

getSecretObjectValue

@Stability(value=Stable)
 @Nullable
default Map<String,SecretValue> getSecretObjectValue()

Initial value for a JSON secret.

NOTE: *It is highly encouraged to leave this field undefined and allow SecretsManager to create the secret value. The secret object -- if provided -- will be included in the output of the cdk as part of synthesis, and will appear in the CloudFormation template in the console. This can be secure(-ish) if that value is merely reference to another resource (or one of its attributes), but if the value is a plaintext string, it will be visible to anyone with access to the CloudFormation template (via the AWS Console, SDKs, or CLI).

Specifies a JSON object that you want to encrypt and store in this new version of the secret. To specify a simple string value instead, use {@link SecretProps.secretStringValue}

Only one of secretStringBeta1, secretStringValue, 'secretObjectValue', and generateSecretString can be provided.

Default: - SecretsManager generates a new secret value.

Example:

 User user;
 AccessKey accessKey;
 Stack stack;
 Secret.Builder.create(stack, "JSONSecret")
         .secretObjectValue(Map.of(
                 "username", SecretValue.unsafePlainText(user.getUserName()),  // intrinsic reference, not exposed as plaintext
                 "database", SecretValue.unsafePlainText("foo"),  // rendered as plain text, but not a secret
                 "password", accessKey.getSecretAccessKey()))
         .build();
 

getSecretStringBeta1

@Stability(value=Deprecated)
 @Deprecated
 @Nullable
default SecretStringValueBeta1 getSecretStringBeta1()

Deprecated. Use `secretStringValue` instead.

(deprecated) Initial value for the secret.

NOTE: *It is highly encouraged to leave this field undefined and allow SecretsManager to create the secret value. The secret string -- if provided -- will be included in the output of the cdk as part of synthesis, and will appear in the CloudFormation template in the console. This can be secure(-ish) if that value is merely reference to another resource (or one of its attributes), but if the value is a plaintext string, it will be visible to anyone with access to the CloudFormation template (via the AWS Console, SDKs, or CLI).

Specifies text data that you want to encrypt and store in this new version of the secret. May be a simple string value, or a string representation of a JSON structure.

Only one of secretStringBeta1, secretStringValue, and generateSecretString can be provided.

Default: - SecretsManager generates a new secret value.

getSecretStringValue

@Stability(value=Stable)
 @Nullable
default SecretValue getSecretStringValue()

Initial value for the secret.

NOTE: *It is highly encouraged to leave this field undefined and allow SecretsManager to create the secret value. The secret string -- if provided -- will be included in the output of the cdk as part of synthesis, and will appear in the CloudFormation template in the console. This can be secure(-ish) if that value is merely reference to another resource (or one of its attributes), but if the value is a plaintext string, it will be visible to anyone with access to the CloudFormation template (via the AWS Console, SDKs, or CLI).

Specifies text data that you want to encrypt and store in this new version of the secret. May be a simple string value. To provide a string representation of JSON structure, use {@link SecretProps.secretObjectValue} instead.

Only one of secretStringBeta1, secretStringValue, 'secretObjectValue', and generateSecretString can be provided.

Default: - SecretsManager generates a new secret value.

builder

@Stability(value=Stable)
static SecretProps.Builder builder()

Returns:

a SecretProps.Builder of SecretProps