AWS Secrets Manager

Store, read and manage secrets in AWS Secrets Manager: read secret values (singly or in batches), create secrets and store new versions, roll back by moving version labels, tag, delete and restore secrets, manage resource policies and cross-region replicas, and generate random passwords.

Actions

Action	What it does
Create secret	Create a secret, with its first value.
Delete resource policy	Remove the resource policy from a secret.
Delete secret	Schedule a secret for deletion after a recovery window (7-30 days, default 30), during which Restore secret brings it back - or delete it immediately.
Describe secret	Read a secret's metadata - description, tags, versions and their labels, rotation, replicas and deletion date - without its value.
Generate random password	Generate a random password to store in a secret.
Get resource policy	Read the resource policy attached to a secret, if it has one.
Get secret value	Read a secret's value - the current version unless a version id or label is given.
Get several secret values	Read up to 20 secrets' values in one step, either named in a list or chosen by a filter (not both).
List secret versions	List a secret's versions and their labels (no values), plus the id of the current one.
List secrets	List the secrets in the connection's region with their metadata - never their values.
Move secret version label	Move a label such as AWSCURRENT from one version to another - this is how a secret is rolled back.
Put secret value	Store a new value as a new version.
Remove replica regions	Stop replicating a secret to regions and delete those replicas.
Remove secret tags	Remove tags from a secret by key.
Replicate secret to regions	Copy a secret into other regions and keep them in sync.
Restore secret	Cancel a secret's scheduled deletion.
Set resource policy	Attach a resource policy to a secret, replacing any existing one.
Tag secret	Add tags to a secret, overwriting the value of any key it already has.
Update secret	Change a secret's description, KMS key and/or value.
Validate resource policy	Check a resource policy for errors and public access without saving it.

Create secret

Create a secret, with its first value. AWS bills $0.40 per secret per month (prorated) from creation.

Inputs

NamenametextRequired: Unique within the region. Letters, digits and / _ + = . @ - ; use / to group, e.g. 'prod/billing/db'. Avoid ending with a hyphen and six characters, which looks like an ARN suffix.
Secret valuesecret_valuetext: The value to store. Plain text, or JSON such as {"username": "app", "password": "..."} - the shape the console's key/value editor uses. An object from an earlier step is stored as JSON.
Descriptiondescriptiontext: A note shown in the console.
Tagstagsobject: Tag keys and values to add.
KMS keykms_key_idtext: A KMS key id, ARN or alias to encrypt with. Leave empty for the default aws/secretsmanager key.

Outputs

resultobject

Example output

{
  "result": {
    "arn": "arn:aws:secretsmanager:us-east-1:123456789012:secret:prod/db-credentials-a1b2c3",
    "name": "prod/db-credentials",
    "version_id": "EXAMPLE1-90ab-cdef-fedc-ba987EXAMPLE"
  }
}

Delete resource policy

Remove the resource policy from a secret.

Inputs

Secretsecret_idtextRequired: The secret's name or ARN. A link to the secret copied from the console also works.

Outputs

resultobject

Example output

{
  "result": {
    "arn": "arn:aws:secretsmanager:us-east-1:123456789012:secret:prod/db-credentials-a1b2c3",
    "name": "prod/db-credentials"
  }
}

Delete secret

Schedule a secret for deletion after a recovery window (7-30 days, default 30), during which Restore secret brings it back - or delete it immediately. A secret with replicas must have them removed first.

Inputs

Secretsecret_idtextRequired: The secret's name or ARN. A link to the secret copied from the console also works.
Recovery window (days)recovery_window_in_daysnumber: Days before deletion (7-30). Leave empty for 30.From 7 to 30.
Delete immediatelyforce_delete_without_recoverytrue/false: Delete now with no way to recover it. Cannot be combined with a recovery window.Default: false.

Outputs

resultobject

Example output

{
  "result": {
    "arn": "arn:aws:secretsmanager:us-east-1:123456789012:secret:prod/db-credentials-a1b2c3",
    "deletion_date": "2026-10-25T10:00:00Z",
    "name": "prod/db-credentials",
    "recoverable": true
  }
}

Describe secret

Read a secret's metadata - description, tags, versions and their labels, rotation, replicas and deletion date - without its value.

Inputs

Secretsecret_idtextRequired: The secret's name or ARN. A link to the secret copied from the console also works.

Outputs

resultobject

Example output

{
  "result": {
    "secret": {
      "arn": "arn:aws:secretsmanager:us-east-1:123456789012:secret:prod/db-credentials-a1b2c3",
      "created_date": "2026-09-01T10:00:00Z",
      "deleted_date": null,
      "description": "Database credentials for the billing app.",
      "kms_key_id": null,
      "last_accessed_date": "2026-09-25T00:00:00Z",
      "last_changed_date": "2026-09-20T08:30:00Z",
      "last_rotated_date": null,
      "name": "prod/db-credentials",
      "next_rotation_date": null,
      "owning_service": null,
      "primary_region": "us-east-1",
      "replication_status": [],
      "rotation_enabled": false,
      "rotation_lambda_arn": null,
      "rotation_rules": null,
      "scheduled_for_deletion": false,
      "tag_map": {
        "team": "billing"
      },
      "tags": [
        {
          "key": "team",
          "value": "billing"
        }
      ],
      "type": null,
      "version_ids_to_stages": {
        "EXAMPLE1-90ab-cdef-fedc-ba987EXAMPLE": [
          "AWSPREVIOUS"
        ],
        "EXAMPLE2-90ab-cdef-fedc-ba987EXAMPLE": [
          "AWSCURRENT"
        ]
      }
    }
  }
}

Generate random password

Generate a random password to store in a secret. Nothing is saved by this step.

Inputs

Lengthpassword_lengthnumber: Number of characters (1-4096). Leave empty for 32.From 1 to 4096.
Characters to leave outexclude_characterstext: Any characters the password must not contain, e.g. "'\/@
No punctuationexclude_punctuationtrue/false: Leave out punctuation characters.Default: false.
No numbersexclude_numberstrue/false: Leave out digits.Default: false.
No uppercaseexclude_uppercasetrue/false: Leave out uppercase letters.Default: false.
No lowercaseexclude_lowercasetrue/false: Leave out lowercase letters.Default: false.
Allow spacesinclude_spacetrue/false: Allow the space character.Default: false.
At least one of each typerequire_each_included_typetrue/false: Include at least one character of every allowed type.Default: true.

Outputs

resultobject

Example output

{
  "result": {
    "length": 29,
    "password": "EXAMPLE-PASSWORD-q8Zr4mXw2Lp9"
  }
}

Get resource policy

Read the resource policy attached to a secret, if it has one.

Inputs

Secretsecret_idtextRequired: The secret's name or ARN. A link to the secret copied from the console also works.

Outputs

resultobject

Example output

{
  "result": {
    "arn": "arn:aws:secretsmanager:us-east-1:123456789012:secret:prod/db-credentials-a1b2c3",
    "has_policy": false,
    "name": "prod/db-credentials",
    "resource_policy": null,
    "resource_policy_json": null
  }
}

Get secret value

Read a secret's value - the current version unless a version id or label is given. A JSON value is also returned parsed as secret_json, so a later step can use secret_json.password.

Inputs

Secretsecret_idtextRequired: The secret's name or ARN. A link to the secret copied from the console also works.
Version labelversion_stagetext: Read the version carrying this label. Leave empty for AWSCURRENT.
Version idversion_idtext: Read this exact version instead. If a label is also given, it must be on this version.

Outputs

resultobject

Example output

{
  "result": {
    "secret_value": {
      "arn": "arn:aws:secretsmanager:us-east-1:123456789012:secret:prod/db-credentials-a1b2c3",
      "created_date": "2026-09-20T08:30:00Z",
      "name": "prod/db-credentials",
      "secret_binary": null,
      "secret_json": {
        "password": "s3cr3t",
        "username": "app"
      },
      "secret_string": "{\"username\":\"app\",\"password\":\"s3cr3t\"}",
      "version_id": "EXAMPLE2-90ab-cdef-fedc-ba987EXAMPLE",
      "version_stages": [
        "AWSCURRENT"
      ]
    }
  }
}

Get several secret values

Read up to 20 secrets' values in one step, either named in a list or chosen by a filter (not both). Secrets that could not be read are listed in errors.

Inputs

Secretssecret_idslist: Up to 20 secret names or ARNs.
Filter byfilter_keytext: Which field Filter values are matched against.One of: name (Name starts with (case-sensitive)), description (Description starts with), tag-key (Tag key starts with (case-sensitive)), tag-value (Tag value starts with (case-sensitive)), primary-region (Primary region starts with), owning-service (Owning service starts with), all (Any field contains these words).
Filter valuesfilter_valueslist: Up to 10 values; a secret matches if any one matches. Start a value with ! to exclude matches instead.
Max resultsmax_resultsnumber: Secrets per page when using a filter (1-20).From 1 to 20.
Next tokennext_tokentext: The next_token from the previous page. Leave empty for page 1.

Outputs

resultobject

Example output

{
  "result": {
    "count": 1,
    "error_count": 0,
    "errors": [],
    "has_more": false,
    "next_token": null,
    "secret_values": [
      {
        "arn": "arn:aws:secretsmanager:us-east-1:123456789012:secret:prod/db-credentials-a1b2c3",
        "created_date": "2026-09-20T08:30:00Z",
        "name": "prod/db-credentials",
        "secret_binary": null,
        "secret_json": {
          "password": "s3cr3t",
          "username": "app"
        },
        "secret_string": "{\"username\":\"app\",\"password\":\"s3cr3t\"}",
        "version_id": "EXAMPLE2-90ab-cdef-fedc-ba987EXAMPLE",
        "version_stages": [
          "AWSCURRENT"
        ]
      }
    ]
  }
}

List secret versions

List a secret's versions and their labels (no values), plus the id of the current one.

Inputs

Secretsecret_idtextRequired: The secret's name or ARN. A link to the secret copied from the console also works.
Include unlabelled versionsinclude_deprecatedtrue/false: Also list old versions that no longer carry a label and will eventually be removed.Default: false.
Max resultsmax_resultsnumber: Versions per page (1-100).From 1 to 100.
Next tokennext_tokentext: The next_token from the previous page. Leave empty for page 1.

Outputs

resultobject

Example output

{
  "result": {
    "arn": "arn:aws:secretsmanager:us-east-1:123456789012:secret:prod/db-credentials-a1b2c3",
    "count": 1,
    "current_version_id": "EXAMPLE2-90ab-cdef-fedc-ba987EXAMPLE",
    "has_more": false,
    "name": "prod/db-credentials",
    "next_token": null,
    "versions": [
      {
        "created_date": "2026-09-20T08:30:00Z",
        "kms_key_ids": [
          "DefaultEncryptionKey"
        ],
        "last_accessed_date": "2026-09-25T00:00:00Z",
        "version_id": "EXAMPLE2-90ab-cdef-fedc-ba987EXAMPLE",
        "version_stages": [
          "AWSCURRENT"
        ]
      }
    ]
  }
}

List secrets

List the secrets in the connection's region with their metadata - never their values. The list can lag a few minutes behind changes.

Inputs

Filter byfilter_keytext: Which field Filter values are matched against.One of: name (Name starts with (case-sensitive)), description (Description starts with), tag-key (Tag key starts with (case-sensitive)), tag-value (Tag value starts with (case-sensitive)), primary-region (Primary region starts with), owning-service (Owning service starts with), all (Any field contains these words).
Filter valuesfilter_valueslist: Up to 10 values; a secret matches if any one matches. Start a value with ! to exclude matches instead.
Include secrets scheduled for deletioninclude_planned_deletiontrue/false: Also list secrets in their recovery window.Default: false.
Sort bysort_bytext: The field to sort on.One of: created-date (Created date), last-accessed-date (Last accessed date), last-changed-date (Last changed date), name.
Sort ordersort_ordertext: Ascending or descending.One of: asc (Ascending), desc (Descending).
Max resultsmax_resultsnumber: Secrets per page (1-100).From 1 to 100.
Next tokennext_tokentext: The next_token from the previous page. Leave empty for page 1.

Outputs

resultobject

Example output

{
  "result": {
    "count": 1,
    "has_more": false,
    "next_token": null,
    "secrets": [
      {
        "arn": "arn:aws:secretsmanager:us-east-1:123456789012:secret:prod/db-credentials-a1b2c3",
        "created_date": "2026-09-01T10:00:00Z",
        "deleted_date": null,
        "description": "Database credentials for the billing app.",
        "kms_key_id": null,
        "last_accessed_date": "2026-09-25T00:00:00Z",
        "last_changed_date": "2026-09-20T08:30:00Z",
        "last_rotated_date": null,
        "name": "prod/db-credentials",
        "next_rotation_date": null,
        "owning_service": null,
        "primary_region": "us-east-1",
        "replication_status": [],
        "rotation_enabled": false,
        "rotation_lambda_arn": null,
        "rotation_rules": null,
        "scheduled_for_deletion": false,
        "tag_map": {
          "team": "billing"
        },
        "tags": [
          {
            "key": "team",
            "value": "billing"
          }
        ],
        "type": null,
        "version_ids_to_stages": {
          "EXAMPLE1-90ab-cdef-fedc-ba987EXAMPLE": [
            "AWSPREVIOUS"
          ],
          "EXAMPLE2-90ab-cdef-fedc-ba987EXAMPLE": [
            "AWSCURRENT"
          ]
        }
      }
    ]
  }
}

Move secret version label

Move a label such as AWSCURRENT from one version to another - this is how a secret is rolled back. When the label is already on a version, give that version as 'Remove from version'. Moving AWSCURRENT also moves AWSPREVIOUS.

Inputs

Secretsecret_idtextRequired: The secret's name or ARN. A link to the secret copied from the console also works.
Labelversion_stagetextRequired: The label to move, e.g. AWSCURRENT.
Move to versionmove_to_version_idtext: The version to put the label on. Leave empty to only remove it.
Remove from versionremove_from_version_idtext: The version that has the label now.

Outputs

resultobject

Example output

{
  "result": {
    "arn": "arn:aws:secretsmanager:us-east-1:123456789012:secret:prod/db-credentials-a1b2c3",
    "moved_to_version_id": "EXAMPLE1-90ab-cdef-fedc-ba987EXAMPLE",
    "name": "prod/db-credentials",
    "removed_from_version_id": "EXAMPLE2-90ab-cdef-fedc-ba987EXAMPLE",
    "version_stage": "AWSCURRENT"
  }
}

Put secret value

Store a new value as a new version. It becomes AWSCURRENT unless labels are given. Avoid storing new values more often than every 10 minutes - a secret holds at most 100 versions.

Inputs

Secretsecret_idtextRequired: The secret's name or ARN. A link to the secret copied from the console also works.
Secret valuesecret_valuetextRequired: The value to store. Plain text, or JSON such as {"username": "app", "password": "..."} - the shape the console's key/value editor uses. An object from an earlier step is stored as JSON.
Version labelsversion_stageslist: Labels to put on the new version. Leave empty to make it AWSCURRENT; give e.g. AWSPENDING to stage it without switching over.

Outputs

resultobject

Example output

{
  "result": {
    "arn": "arn:aws:secretsmanager:us-east-1:123456789012:secret:prod/db-credentials-a1b2c3",
    "name": "prod/db-credentials",
    "version_id": "EXAMPLE2-90ab-cdef-fedc-ba987EXAMPLE",
    "version_stages": [
      "AWSCURRENT"
    ]
  }
}

Remove replica regions

Stop replicating a secret to regions and delete those replicas.

Inputs

Secretsecret_idtextRequired: The secret's name or ARN. A link to the secret copied from the console also works.
RegionsregionslistRequired: Region codes, for example us-west-2 or eu-central-1.

Outputs

resultobject

Example output

{
  "result": {
    "arn": "arn:aws:secretsmanager:us-east-1:123456789012:secret:prod/db-credentials-a1b2c3",
    "removed_regions": [
      "us-west-2"
    ],
    "replication_status": []
  }
}

Remove secret tags

Remove tags from a secret by key.

Inputs

Secretsecret_idtextRequired: The secret's name or ARN. A link to the secret copied from the console also works.
Tag keystag_keyslistRequired: The keys of the tags to remove.

Outputs

resultobject

Example output

{
  "result": {
    "secret_id": "prod/db-credentials",
    "tag_keys": [
      "team"
    ],
    "untagged": true
  }
}

Replicate secret to regions

Copy a secret into other regions and keep them in sync. Each replica is billed as a secret. Replication finishes in the background - check replication_status with Describe secret.

Inputs

Secretsecret_idtextRequired: The secret's name or ARN. A link to the secret copied from the console also works.
RegionsregionslistRequired: Region codes, for example us-west-2 or eu-central-1.
KMS keykms_key_idtext: A KMS key id, ARN or alias that exists in every target region. Leave empty for each region's default aws/secretsmanager key.
Overwrite existing secretsforce_overwrite_replica_secrettrue/false: Replace a secret of the same name already in a target region.Default: false.

Outputs

resultobject

Example output

{
  "result": {
    "arn": "arn:aws:secretsmanager:us-east-1:123456789012:secret:prod/db-credentials-a1b2c3",
    "replication_status": [
      {
        "kms_key_id": "alias/aws/secretsmanager",
        "last_accessed_date": null,
        "region": "us-west-2",
        "status": "InProgress",
        "status_message": "Replication in progress..."
      }
    ]
  }
}

Restore secret

Cancel a secret's scheduled deletion.

Inputs

Secretsecret_idtextRequired: The secret's name or ARN. A link to the secret copied from the console also works.

Outputs

resultobject

Example output

{
  "result": {
    "arn": "arn:aws:secretsmanager:us-east-1:123456789012:secret:prod/db-credentials-a1b2c3",
    "name": "prod/db-credentials"
  }
}

Set resource policy

Attach a resource policy to a secret, replacing any existing one. Policies that would make the secret public are blocked unless you turn that off.

Inputs

Secretsecret_idtextRequired: The secret's name or ARN. A link to the secret copied from the console also works.
Policyresource_policytextRequired: The IAM policy document, as JSON.
Block public policiesblock_public_policytrue/false: Reject a policy that gives broad access to the secret. Recommended.Default: true.

Outputs

resultobject

Example output

{
  "result": {
    "arn": "arn:aws:secretsmanager:us-east-1:123456789012:secret:prod/db-credentials-a1b2c3",
    "name": "prod/db-credentials"
  }
}

Tag secret

Add tags to a secret, overwriting the value of any key it already has.

Inputs

Secretsecret_idtextRequired: The secret's name or ARN. A link to the secret copied from the console also works.
TagstagsobjectRequired: Tag keys and values to set.

Outputs

resultobject

Example output

{
  "result": {
    "secret_id": "prod/db-credentials",
    "tag_keys": [
      "team"
    ],
    "tagged": true
  }
}

Update secret

Change a secret's description, KMS key and/or value. A new value becomes the current version and the old one is kept as AWSPREVIOUS. Avoid storing new values more often than every 10 minutes - a secret holds at most 100 versions.

Inputs

Secretsecret_idtextRequired: The secret's name or ARN. A link to the secret copied from the console also works.
Secret valuesecret_valuetext: The value to store. Plain text, or JSON such as {"username": "app", "password": "..."} - the shape the console's key/value editor uses. An object from an earlier step is stored as JSON.
Descriptiondescriptiontext: A new description. Leave empty to keep it.
KMS keykms_key_idtext: A new KMS key id, ARN or alias. Leave empty to keep it.

Outputs

resultobject

Example output

{
  "result": {
    "arn": "arn:aws:secretsmanager:us-east-1:123456789012:secret:prod/db-credentials-a1b2c3",
    "name": "prod/db-credentials",
    "version_id": "EXAMPLE2-90ab-cdef-fedc-ba987EXAMPLE"
  }
}

Validate resource policy

Check a resource policy for errors and public access without saving it. Needs both the ValidateResourcePolicy and PutResourcePolicy permissions.

Inputs

Policyresource_policytextRequired: The IAM policy document, as JSON.
Secretsecret_idtext: Optional: the secret the policy is for.

Outputs

resultobject

Example output

{
  "result": {
    "error_count": 0,
    "passed": true,
    "validation_errors": []
  }
}

ActionsCopy Anchor Link

Create secretCopy Anchor Link

Inputs

Outputs

Delete resource policyCopy Anchor Link

Inputs

Outputs

Delete secretCopy Anchor Link

Inputs

Outputs

Describe secretCopy Anchor Link

Inputs

Outputs

Generate random passwordCopy Anchor Link

Inputs

Outputs

Get resource policyCopy Anchor Link

Inputs

Outputs

Get secret valueCopy Anchor Link

Inputs

Outputs

Get several secret valuesCopy Anchor Link

Inputs

Outputs

List secret versionsCopy Anchor Link

Inputs

Outputs

List secretsCopy Anchor Link

Inputs

Outputs

Move secret version labelCopy Anchor Link

Inputs

Outputs

Put secret valueCopy Anchor Link

Inputs

Outputs

Remove replica regionsCopy Anchor Link

Inputs

Outputs

Remove secret tagsCopy Anchor Link

Inputs

Outputs

Replicate secret to regionsCopy Anchor Link

Inputs

Outputs

Restore secretCopy Anchor Link

Inputs

Outputs

Set resource policyCopy Anchor Link

Inputs

Outputs

Tag secretCopy Anchor Link

Inputs

Outputs

Update secretCopy Anchor Link

Inputs

Outputs

Validate resource policyCopy Anchor Link

Inputs

Outputs

On this page

Actions

Create secret

Delete resource policy

Delete secret

Describe secret

Generate random password

Get resource policy

Get secret value

Get several secret values

List secret versions

List secrets

Move secret version label

Put secret value

Remove replica regions

Remove secret tags

Replicate secret to regions

Restore secret

Set resource policy

Tag secret

Update secret

Validate resource policy