# AWS Secrets Manager

> Store, read and manage secrets in AWS Secrets Manager: read secret values (singly or in batches), create secrets and store new versions, roll back by moving version labels, tag, delete and restore secrets, manage resource policies and cross-region replicas, and generate random passwords.

App · Compliance & Security · 20 actions. Web page: https://docs.lodol.com/docs/integrations/aws-secrets-manager

## Actions

### Create secret

Create a secret, with its first value. AWS bills $0.40 per secret per month (prorated) from creation.

**Inputs**

- Name (`name`, text, required): Unique within the region. Letters, digits and / _ + = . @ - ; use / to group, e.g. 'prod/billing/db'. Avoid ending with a hyphen and six characters, which looks like an ARN suffix.
- Secret value (`secret_value`, text): The value to store. Plain text, or JSON such as {"username": "app", "password": "..."} - the shape the console's key/value editor uses. An object from an earlier step is stored as JSON.
- Description (`description`, text): A note shown in the console.
- Tags (`tags`, object): Tag keys and values to add.
- KMS key (`kms_key_id`, text): A KMS key id, ARN or alias to encrypt with. Leave empty for the default aws/secretsmanager key.

**Outputs**

- `result` (object)

**Example output**

```json
{
  "result": {
    "arn": "arn:aws:secretsmanager:us-east-1:123456789012:secret:prod/db-credentials-a1b2c3",
    "name": "prod/db-credentials",
    "version_id": "EXAMPLE1-90ab-cdef-fedc-ba987EXAMPLE"
  }
}
```

### Delete resource policy

Remove the resource policy from a secret.

**Inputs**

- Secret (`secret_id`, text, required): The secret's name or ARN. A link to the secret copied from the console also works.

**Outputs**

- `result` (object)

**Example output**

```json
{
  "result": {
    "arn": "arn:aws:secretsmanager:us-east-1:123456789012:secret:prod/db-credentials-a1b2c3",
    "name": "prod/db-credentials"
  }
}
```

### Delete secret

Schedule a secret for deletion after a recovery window (7-30 days, default 30), during which Restore secret brings it back - or delete it immediately. A secret with replicas must have them removed first.

**Inputs**

- Secret (`secret_id`, text, required): The secret's name or ARN. A link to the secret copied from the console also works.
- Recovery window (days) (`recovery_window_in_days`, number): Days before deletion (7-30). Leave empty for 30. From 7 to 30.
- Delete immediately (`force_delete_without_recovery`, true/false): Delete now with no way to recover it. Cannot be combined with a recovery window. Default: `false`.

**Outputs**

- `result` (object)

**Example output**

```json
{
  "result": {
    "arn": "arn:aws:secretsmanager:us-east-1:123456789012:secret:prod/db-credentials-a1b2c3",
    "deletion_date": "2026-10-25T10:00:00Z",
    "name": "prod/db-credentials",
    "recoverable": true
  }
}
```

### Describe secret

Read a secret's metadata - description, tags, versions and their labels, rotation, replicas and deletion date - without its value.

**Inputs**

- Secret (`secret_id`, text, required): The secret's name or ARN. A link to the secret copied from the console also works.

**Outputs**

- `result` (object)

**Example output**

```json
{
  "result": {
    "secret": {
      "arn": "arn:aws:secretsmanager:us-east-1:123456789012:secret:prod/db-credentials-a1b2c3",
      "created_date": "2026-09-01T10:00:00Z",
      "deleted_date": null,
      "description": "Database credentials for the billing app.",
      "kms_key_id": null,
      "last_accessed_date": "2026-09-25T00:00:00Z",
      "last_changed_date": "2026-09-20T08:30:00Z",
      "last_rotated_date": null,
      "name": "prod/db-credentials",
      "next_rotation_date": null,
      "owning_service": null,
      "primary_region": "us-east-1",
      "replication_status": [],
      "rotation_enabled": false,
      "rotation_lambda_arn": null,
      "rotation_rules": null,
      "scheduled_for_deletion": false,
      "tag_map": {
        "team": "billing"
      },
      "tags": [
        {
          "key": "team",
          "value": "billing"
        }
      ],
      "type": null,
      "version_ids_to_stages": {
        "EXAMPLE1-90ab-cdef-fedc-ba987EXAMPLE": [
          "AWSPREVIOUS"
        ],
        "EXAMPLE2-90ab-cdef-fedc-ba987EXAMPLE": [
          "AWSCURRENT"
        ]
      }
    }
  }
}
```

### Generate random password

Generate a random password to store in a secret. Nothing is saved by this step.

**Inputs**

- Length (`password_length`, number): Number of characters (1-4096). Leave empty for 32. From 1 to 4096.
- Characters to leave out (`exclude_characters`, text): Any characters the password must not contain, e.g. "'\/@
- No punctuation (`exclude_punctuation`, true/false): Leave out punctuation characters. Default: `false`.
- No numbers (`exclude_numbers`, true/false): Leave out digits. Default: `false`.
- No uppercase (`exclude_uppercase`, true/false): Leave out uppercase letters. Default: `false`.
- No lowercase (`exclude_lowercase`, true/false): Leave out lowercase letters. Default: `false`.
- Allow spaces (`include_space`, true/false): Allow the space character. Default: `false`.
- At least one of each type (`require_each_included_type`, true/false): Include at least one character of every allowed type. Default: `true`.

**Outputs**

- `result` (object)

**Example output**

```json
{
  "result": {
    "length": 29,
    "password": "EXAMPLE-PASSWORD-q8Zr4mXw2Lp9"
  }
}
```

### Get resource policy

Read the resource policy attached to a secret, if it has one.

**Inputs**

- Secret (`secret_id`, text, required): The secret's name or ARN. A link to the secret copied from the console also works.

**Outputs**

- `result` (object)

**Example output**

```json
{
  "result": {
    "arn": "arn:aws:secretsmanager:us-east-1:123456789012:secret:prod/db-credentials-a1b2c3",
    "has_policy": false,
    "name": "prod/db-credentials",
    "resource_policy": null,
    "resource_policy_json": null
  }
}
```

### Get secret value

Read a secret's value - the current version unless a version id or label is given. A JSON value is also returned parsed as secret_json, so a later step can use secret_json.password.

**Inputs**

- Secret (`secret_id`, text, required): The secret's name or ARN. A link to the secret copied from the console also works.
- Version label (`version_stage`, text): Read the version carrying this label. Leave empty for AWSCURRENT.
- Version id (`version_id`, text): Read this exact version instead. If a label is also given, it must be on this version.

**Outputs**

- `result` (object)

**Example output**

```json
{
  "result": {
    "secret_value": {
      "arn": "arn:aws:secretsmanager:us-east-1:123456789012:secret:prod/db-credentials-a1b2c3",
      "created_date": "2026-09-20T08:30:00Z",
      "name": "prod/db-credentials",
      "secret_binary": null,
      "secret_json": {
        "password": "s3cr3t",
        "username": "app"
      },
      "secret_string": "{\"username\":\"app\",\"password\":\"s3cr3t\"}",
      "version_id": "EXAMPLE2-90ab-cdef-fedc-ba987EXAMPLE",
      "version_stages": [
        "AWSCURRENT"
      ]
    }
  }
}
```

### Get several secret values

Read up to 20 secrets' values in one step, either named in a list or chosen by a filter (not both). Secrets that could not be read are listed in errors.

**Inputs**

- Secrets (`secret_ids`, list): Up to 20 secret names or ARNs.
- Filter by (`filter_key`, text): Which field Filter values are matched against. One of: `name` (Name starts with (case-sensitive)), `description` (Description starts with), `tag-key` (Tag key starts with (case-sensitive)), `tag-value` (Tag value starts with (case-sensitive)), `primary-region` (Primary region starts with), `owning-service` (Owning service starts with), `all` (Any field contains these words).
- Filter values (`filter_values`, list): Up to 10 values; a secret matches if any one matches. Start a value with ! to exclude matches instead.
- Max results (`max_results`, number): Secrets per page when using a filter (1-20). From 1 to 20.
- Next token (`next_token`, text): The next_token from the previous page. Leave empty for page 1.

**Outputs**

- `result` (object)

**Example output**

```json
{
  "result": {
    "count": 1,
    "error_count": 0,
    "errors": [],
    "has_more": false,
    "next_token": null,
    "secret_values": [
      {
        "arn": "arn:aws:secretsmanager:us-east-1:123456789012:secret:prod/db-credentials-a1b2c3",
        "created_date": "2026-09-20T08:30:00Z",
        "name": "prod/db-credentials",
        "secret_binary": null,
        "secret_json": {
          "password": "s3cr3t",
          "username": "app"
        },
        "secret_string": "{\"username\":\"app\",\"password\":\"s3cr3t\"}",
        "version_id": "EXAMPLE2-90ab-cdef-fedc-ba987EXAMPLE",
        "version_stages": [
          "AWSCURRENT"
        ]
      }
    ]
  }
}
```

### List secret versions

List a secret's versions and their labels (no values), plus the id of the current one.

**Inputs**

- Secret (`secret_id`, text, required): The secret's name or ARN. A link to the secret copied from the console also works.
- Include unlabelled versions (`include_deprecated`, true/false): Also list old versions that no longer carry a label and will eventually be removed. Default: `false`.
- Max results (`max_results`, number): Versions per page (1-100). From 1 to 100.
- Next token (`next_token`, text): The next_token from the previous page. Leave empty for page 1.

**Outputs**

- `result` (object)

**Example output**

```json
{
  "result": {
    "arn": "arn:aws:secretsmanager:us-east-1:123456789012:secret:prod/db-credentials-a1b2c3",
    "count": 1,
    "current_version_id": "EXAMPLE2-90ab-cdef-fedc-ba987EXAMPLE",
    "has_more": false,
    "name": "prod/db-credentials",
    "next_token": null,
    "versions": [
      {
        "created_date": "2026-09-20T08:30:00Z",
        "kms_key_ids": [
          "DefaultEncryptionKey"
        ],
        "last_accessed_date": "2026-09-25T00:00:00Z",
        "version_id": "EXAMPLE2-90ab-cdef-fedc-ba987EXAMPLE",
        "version_stages": [
          "AWSCURRENT"
        ]
      }
    ]
  }
}
```

### List secrets

List the secrets in the connection's region with their metadata - never their values. The list can lag a few minutes behind changes.

**Inputs**

- Filter by (`filter_key`, text): Which field Filter values are matched against. One of: `name` (Name starts with (case-sensitive)), `description` (Description starts with), `tag-key` (Tag key starts with (case-sensitive)), `tag-value` (Tag value starts with (case-sensitive)), `primary-region` (Primary region starts with), `owning-service` (Owning service starts with), `all` (Any field contains these words).
- Filter values (`filter_values`, list): Up to 10 values; a secret matches if any one matches. Start a value with ! to exclude matches instead.
- Include secrets scheduled for deletion (`include_planned_deletion`, true/false): Also list secrets in their recovery window. Default: `false`.
- Sort by (`sort_by`, text): The field to sort on. One of: `created-date` (Created date), `last-accessed-date` (Last accessed date), `last-changed-date` (Last changed date), `name`.
- Sort order (`sort_order`, text): Ascending or descending. One of: `asc` (Ascending), `desc` (Descending).
- Max results (`max_results`, number): Secrets per page (1-100). From 1 to 100.
- Next token (`next_token`, text): The next_token from the previous page. Leave empty for page 1.

**Outputs**

- `result` (object)

**Example output**

```json
{
  "result": {
    "count": 1,
    "has_more": false,
    "next_token": null,
    "secrets": [
      {
        "arn": "arn:aws:secretsmanager:us-east-1:123456789012:secret:prod/db-credentials-a1b2c3",
        "created_date": "2026-09-01T10:00:00Z",
        "deleted_date": null,
        "description": "Database credentials for the billing app.",
        "kms_key_id": null,
        "last_accessed_date": "2026-09-25T00:00:00Z",
        "last_changed_date": "2026-09-20T08:30:00Z",
        "last_rotated_date": null,
        "name": "prod/db-credentials",
        "next_rotation_date": null,
        "owning_service": null,
        "primary_region": "us-east-1",
        "replication_status": [],
        "rotation_enabled": false,
        "rotation_lambda_arn": null,
        "rotation_rules": null,
        "scheduled_for_deletion": false,
        "tag_map": {
          "team": "billing"
        },
        "tags": [
          {
            "key": "team",
            "value": "billing"
          }
        ],
        "type": null,
        "version_ids_to_stages": {
          "EXAMPLE1-90ab-cdef-fedc-ba987EXAMPLE": [
            "AWSPREVIOUS"
          ],
          "EXAMPLE2-90ab-cdef-fedc-ba987EXAMPLE": [
            "AWSCURRENT"
          ]
        }
      }
    ]
  }
}
```

### Move secret version label

Move a label such as AWSCURRENT from one version to another - this is how a secret is rolled back. When the label is already on a version, give that version as 'Remove from version'. Moving AWSCURRENT also moves AWSPREVIOUS.

**Inputs**

- Secret (`secret_id`, text, required): The secret's name or ARN. A link to the secret copied from the console also works.
- Label (`version_stage`, text, required): The label to move, e.g. AWSCURRENT.
- Move to version (`move_to_version_id`, text): The version to put the label on. Leave empty to only remove it.
- Remove from version (`remove_from_version_id`, text): The version that has the label now.

**Outputs**

- `result` (object)

**Example output**

```json
{
  "result": {
    "arn": "arn:aws:secretsmanager:us-east-1:123456789012:secret:prod/db-credentials-a1b2c3",
    "moved_to_version_id": "EXAMPLE1-90ab-cdef-fedc-ba987EXAMPLE",
    "name": "prod/db-credentials",
    "removed_from_version_id": "EXAMPLE2-90ab-cdef-fedc-ba987EXAMPLE",
    "version_stage": "AWSCURRENT"
  }
}
```

### Put secret value

Store a new value as a new version. It becomes AWSCURRENT unless labels are given. Avoid storing new values more often than every 10 minutes - a secret holds at most 100 versions.

**Inputs**

- Secret (`secret_id`, text, required): The secret's name or ARN. A link to the secret copied from the console also works.
- Secret value (`secret_value`, text, required): The value to store. Plain text, or JSON such as {"username": "app", "password": "..."} - the shape the console's key/value editor uses. An object from an earlier step is stored as JSON.
- Version labels (`version_stages`, list): Labels to put on the new version. Leave empty to make it AWSCURRENT; give e.g. AWSPENDING to stage it without switching over.

**Outputs**

- `result` (object)

**Example output**

```json
{
  "result": {
    "arn": "arn:aws:secretsmanager:us-east-1:123456789012:secret:prod/db-credentials-a1b2c3",
    "name": "prod/db-credentials",
    "version_id": "EXAMPLE2-90ab-cdef-fedc-ba987EXAMPLE",
    "version_stages": [
      "AWSCURRENT"
    ]
  }
}
```

### Remove replica regions

Stop replicating a secret to regions and delete those replicas.

**Inputs**

- Secret (`secret_id`, text, required): The secret's name or ARN. A link to the secret copied from the console also works.
- Regions (`regions`, list, required): Region codes, for example us-west-2 or eu-central-1.

**Outputs**

- `result` (object)

**Example output**

```json
{
  "result": {
    "arn": "arn:aws:secretsmanager:us-east-1:123456789012:secret:prod/db-credentials-a1b2c3",
    "removed_regions": [
      "us-west-2"
    ],
    "replication_status": []
  }
}
```

### Remove secret tags

Remove tags from a secret by key.

**Inputs**

- Secret (`secret_id`, text, required): The secret's name or ARN. A link to the secret copied from the console also works.
- Tag keys (`tag_keys`, list, required): The keys of the tags to remove.

**Outputs**

- `result` (object)

**Example output**

```json
{
  "result": {
    "secret_id": "prod/db-credentials",
    "tag_keys": [
      "team"
    ],
    "untagged": true
  }
}
```

### Replicate secret to regions

Copy a secret into other regions and keep them in sync. Each replica is billed as a secret. Replication finishes in the background - check replication_status with Describe secret.

**Inputs**

- Secret (`secret_id`, text, required): The secret's name or ARN. A link to the secret copied from the console also works.
- Regions (`regions`, list, required): Region codes, for example us-west-2 or eu-central-1.
- KMS key (`kms_key_id`, text): A KMS key id, ARN or alias that exists in every target region. Leave empty for each region's default aws/secretsmanager key.
- Overwrite existing secrets (`force_overwrite_replica_secret`, true/false): Replace a secret of the same name already in a target region. Default: `false`.

**Outputs**

- `result` (object)

**Example output**

```json
{
  "result": {
    "arn": "arn:aws:secretsmanager:us-east-1:123456789012:secret:prod/db-credentials-a1b2c3",
    "replication_status": [
      {
        "kms_key_id": "alias/aws/secretsmanager",
        "last_accessed_date": null,
        "region": "us-west-2",
        "status": "InProgress",
        "status_message": "Replication in progress..."
      }
    ]
  }
}
```

### Restore secret

Cancel a secret's scheduled deletion.

**Inputs**

- Secret (`secret_id`, text, required): The secret's name or ARN. A link to the secret copied from the console also works.

**Outputs**

- `result` (object)

**Example output**

```json
{
  "result": {
    "arn": "arn:aws:secretsmanager:us-east-1:123456789012:secret:prod/db-credentials-a1b2c3",
    "name": "prod/db-credentials"
  }
}
```

### Set resource policy

Attach a resource policy to a secret, replacing any existing one. Policies that would make the secret public are blocked unless you turn that off.

**Inputs**

- Secret (`secret_id`, text, required): The secret's name or ARN. A link to the secret copied from the console also works.
- Policy (`resource_policy`, text, required): The IAM policy document, as JSON.
- Block public policies (`block_public_policy`, true/false): Reject a policy that gives broad access to the secret. Recommended. Default: `true`.

**Outputs**

- `result` (object)

**Example output**

```json
{
  "result": {
    "arn": "arn:aws:secretsmanager:us-east-1:123456789012:secret:prod/db-credentials-a1b2c3",
    "name": "prod/db-credentials"
  }
}
```

### Tag secret

Add tags to a secret, overwriting the value of any key it already has.

**Inputs**

- Secret (`secret_id`, text, required): The secret's name or ARN. A link to the secret copied from the console also works.
- Tags (`tags`, object, required): Tag keys and values to set.

**Outputs**

- `result` (object)

**Example output**

```json
{
  "result": {
    "secret_id": "prod/db-credentials",
    "tag_keys": [
      "team"
    ],
    "tagged": true
  }
}
```

### Update secret

Change a secret's description, KMS key and/or value. A new value becomes the current version and the old one is kept as AWSPREVIOUS. Avoid storing new values more often than every 10 minutes - a secret holds at most 100 versions.

**Inputs**

- Secret (`secret_id`, text, required): The secret's name or ARN. A link to the secret copied from the console also works.
- Secret value (`secret_value`, text): The value to store. Plain text, or JSON such as {"username": "app", "password": "..."} - the shape the console's key/value editor uses. An object from an earlier step is stored as JSON.
- Description (`description`, text): A new description. Leave empty to keep it.
- KMS key (`kms_key_id`, text): A new KMS key id, ARN or alias. Leave empty to keep it.

**Outputs**

- `result` (object)

**Example output**

```json
{
  "result": {
    "arn": "arn:aws:secretsmanager:us-east-1:123456789012:secret:prod/db-credentials-a1b2c3",
    "name": "prod/db-credentials",
    "version_id": "EXAMPLE2-90ab-cdef-fedc-ba987EXAMPLE"
  }
}
```

### Validate resource policy

Check a resource policy for errors and public access without saving it. Needs both the ValidateResourcePolicy and PutResourcePolicy permissions.

**Inputs**

- Policy (`resource_policy`, text, required): The IAM policy document, as JSON.
- Secret (`secret_id`, text): Optional: the secret the policy is for.

**Outputs**

- `result` (object)

**Example output**

```json
{
  "result": {
    "error_count": 0,
    "passed": true,
    "validation_errors": []
  }
}
```