{"id":24956209,"url":"https://github.com/jenkinsci/aws-secrets-manager-credentials-provider-plugin","last_synced_at":"2025-04-05T20:06:16.979Z","repository":{"id":37429302,"uuid":"186543600","full_name":"jenkinsci/aws-secrets-manager-credentials-provider-plugin","owner":"jenkinsci","description":"AWS Secrets Manager Credentials Provider for Jenkins","archived":false,"fork":false,"pushed_at":"2025-01-27T10:14:00.000Z","size":1315,"stargazers_count":63,"open_issues_count":34,"forks_count":44,"subscribers_count":5,"default_branch":"master","last_synced_at":"2025-03-29T19:04:01.496Z","etag":null,"topics":["aws","credentials","jenkins","secrets","secretsmanager"],"latest_commit_sha":null,"homepage":"https://plugins.jenkins.io/aws-secrets-manager-credentials-provider/","language":"Java","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/jenkinsci.png","metadata":{"files":{"readme":"docs/README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2019-05-14T04:17:43.000Z","updated_at":"2025-01-27T10:14:05.000Z","dependencies_parsed_at":"2023-12-11T18:38:09.899Z","dependency_job_id":"8bf6f7a0-786e-46b1-a38b-9d557fd2d189","html_url":"https://github.com/jenkinsci/aws-secrets-manager-credentials-provider-plugin","commit_stats":null,"previous_names":[],"tags_count":34,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jenkinsci%2Faws-secrets-manager-credentials-provider-plugin","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jenkinsci%2Faws-secrets-manager-credentials-provider-plugin/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jenkinsci%2Faws-secrets-manager-credentials-provider-plugin/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jenkinsci%2Faws-secrets-manager-credentials-provider-plugin/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/jenkinsci","download_url":"https://codeload.github.com/jenkinsci/aws-secrets-manager-credentials-provider-plugin/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":247393569,"owners_count":20931812,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["aws","credentials","jenkins","secrets","secretsmanager"],"created_at":"2025-02-03T06:28:08.807Z","updated_at":"2025-04-05T20:06:16.946Z","avatar_url":"https://github.com/jenkinsci.png","language":"Java","funding_links":[],"categories":[],"sub_categories":[],"readme":"# AWS Secrets Manager Credentials Provider\n\n[![Build Status](https://ci.jenkins.io/buildStatus/icon?job=Plugins/aws-secrets-manager-credentials-provider-plugin/master)](https://ci.jenkins.io/blue/organizations/jenkins/Plugins%2Faws-secrets-manager-credentials-provider-plugin/activity/)\n[![Jenkins Plugin](https://img.shields.io/jenkins/plugin/v/aws-secrets-manager-credentials-provider.svg)](https://plugins.jenkins.io/aws-secrets-manager-credentials-provider)\n\nAccess credentials from AWS Secrets Manager in your Jenkins jobs.\n\nThis plugin is the high-level counterpart of the [AWS Secrets Manager SecretSource](https://github.com/jenkinsci/aws-secrets-manager-secret-source-plugin) plugin. You can use either plugin individually, or use both of them.\n\n## Contents\n\n- [Beta Features](beta/index.md)\n- [Caching](caching/index.md)\n- [Client](client/index.md)\n- [Cross-Account Access](cross-account/index.md)\n- [Filters](filters/index.md)\n- [Networking](networking/index.md)\n- [Screenshots](screenshots/index.md)\n- [Transformations](transformations/index.md)\n- [Troubleshooting](troubleshooting/index.md)\n- Project\n  - [Changelog](https://github.com/jenkinsci/aws-secrets-manager-credentials-provider-plugin/releases)\n  - [CI Build](https://ci.jenkins.io/blue/organizations/jenkins/Plugins%2Faws-secrets-manager-credentials-provider-plugin/)\n\n## Features\n\n- Read-only view of Secrets Manager.\n- `CredentialsProvider` API support.\n- Credential metadata caching (duration: 5 minutes).\n \n## Setup\n\n### IAM\n\nGive Jenkins read access to Secrets Manager with an IAM policy.\n\nRequired permissions:\n\n- `secretsmanager:GetSecretValue`\n- `secretsmanager:ListSecrets`\n\nOptional permissions:\n\n- `kms:Decrypt` (if you use a customer-managed KMS key to encrypt the secret)\n\nExample:\n\n```json\n{\n    \"Version\": \"2012-10-17\",\n    \"Statement\": [\n        {\n            \"Sid\": \"AllowJenkinsToGetSecretValues\",\n            \"Effect\": \"Allow\",\n            \"Action\": \"secretsmanager:GetSecretValue\",\n            \"Resource\": \"*\"\n        },\n        {\n            \"Sid\": \"AllowJenkinsToListSecrets\",\n            \"Effect\": \"Allow\",\n            \"Action\": \"secretsmanager:ListSecrets\"\n        }\n    ]\n}\n```\n\n### Jenkins\n\nThe plugin uses the AWS Java SDK to communicate with Secrets Manager. If you are running Jenkins outside EC2 or EKS you may need to manually configure the SDK to authenticate with AWS. See the [client](client/index.md) configuration guide for more information.\n\nThen, install and [configure](#Configuration) the plugin.\n\n## Usage\n\nThe plugin allows secrets from Secrets Manager to be used as Jenkins credentials.\n\nSecrets must conform to the following rules to be usable in Jenkins:\n\n- A secret must have the relevant AWS tags (shown in the sections below) to indicate which Jenkins [credential type](https://jenkins.io/doc/pipeline/steps/credentials-binding/) it is meant to be (e.g. Secret Text, Username With Password). You must add these tags to the secrets. Without these tags, the corresponding credentials will not appear in Jenkins.\n- The secret name should conform to Jenkins credential naming rules, as defined in the [credentials-plugin](https://github.com/jenkinsci/credentials-plugin). That is, it should only contain the following characters: `[a-zA-Z0-9_.-]+`. If it contains other characters, you may see undefined behaviour within Jenkins (e.g. URLs containing the credential's ID may not work).\n\nNote: if you have credentials caching enabled, you must wait for the cache to reset before changes to the secrets appear.\n\n### Secret Text\n\nA simple text *secret*.\n\n- Value: *secret*\n- Tags:\n  - `jenkins:credentials:type` = `string`\n\n#### Example\n\nAWS CLI:\n\n```bash\naws secretsmanager create-secret --name 'newrelic-api-key' --secret-string 'abc123' --tags 'Key=jenkins:credentials:type,Value=string' --description 'Acme Corp Newrelic API key'\n```\n\nDeclarative Pipeline:\n\n```groovy\npipeline {\n    agent any\n    environment {\n        NEWRELIC_API_KEY = credentials('newrelic-api-key')\n    }\n    stages {\n        stage('Foo') {\n            steps {\n              echo 'Hello world'\n            }\n        }\n    }\n}\n```\n\nScripted Pipeline:\n\n```groovy\nnode {\n    withCredentials([string(credentialsId: 'newrelic-api-key', variable: 'NEWRELIC_API_KEY')]) {\n        echo 'Hello world'\n    }\n}\n```\n\n### Username with Password\n\nA *username* and *password* pair.\n\n- Value: *password*\n- Tags:\n  - `jenkins:credentials:type` = `usernamePassword`\n  - `jenkins:credentials:username` = *username*\n\n#### Example\n\nAWS CLI:\n\n```bash\naws secretsmanager create-secret --name 'artifactory' --secret-string 'supersecret' --tags 'Key=jenkins:credentials:type,Value=usernamePassword' 'Key=jenkins:credentials:username,Value=joe' --description 'Acme Corp Artifactory login'\n```\n\nDeclarative Pipeline:\n\n```groovy\npipeline {\n    agent any\n    environment {\n        // Creates variables ARTIFACTORY=joe:supersecret, ARTIFACTORY_USR=joe, ARTIFACTORY_PSW=supersecret\n        ARTIFACTORY = credentials('artifactory')\n    }\n    stages {\n        stage('Foo') {\n            steps {\n              echo 'Hello world'\n            }\n        }\n    }\n}\n```\n\nScripted Pipeline:\n\n```groovy\nnode {\n    withCredentials([usernamePassword(credentialsId: 'artifactory', usernameVariable: 'ARTIFACTORY_USR', passwordVariable: 'ARTIFACTORY_PSW')]) {\n        echo 'Hello world'\n    }\n}\n```\n\n### SSH User Private Key\n\nAn SSH *private key*, with a *username*.\n\n- Value: *private key*\n- Tags:\n  - `jenkins:credentials:type` = `sshUserPrivateKey`\n  - `jenkins:credentials:username` = *username*\n\nCommon private key formats include PKCS#1 (starts with `-----BEGIN [ALGORITHM] PRIVATE KEY-----`) and PKCS#8 (starts with `-----BEGIN PRIVATE KEY-----`).\n\n**Note:** The passphrase field is not supported. (The `SSHUserPrivateKey#getPassphrase()` implementation returns an empty string if called.) This is because any passphrase would have to be stored as a tag on the AWS secret, but tags are non-secret metadata (visible in any `ListSecrets` API call), so the passphrase would offer no meaningful security benefit in this provider.\n\n#### Example\n\nAWS CLI:\n\n```bash\nssh-keygen -t rsa -b 4096 -C 'acme@example.com' -f id_rsa\naws secretsmanager create-secret --name 'ssh-key' --secret-string 'file://id_rsa' --tags 'Key=jenkins:credentials:type,Value=sshUserPrivateKey' 'Key=jenkins:credentials:username,Value=joe' --description 'Acme Corp SSH key'\n```\n\nDeclarative Pipeline:\n\n```groovy\npipeline {\n    agent any\n    environment {\n        // Creates variables KEY=/temp/path/to/key, KEY_USR=joe\n        KEY = credentials('ssh-key')\n    }\n    stages {\n        stage('Foo') {\n            steps {\n              echo 'Hello world'\n            }\n        }\n    }\n}\n```\n\nScripted Pipeline:\n\n```groovy\nnode {\n    withCredentials([sshUserPrivateKey(credentialsId: 'ssh-key', keyFileVariable: 'KEY', usernameVariable: 'KEY_USR')]) {\n        echo 'Hello world'\n    }\n}\n```\n\n### Certificate\n\nA client certificate *keystore* in PKCS#12 format, encrypted with a zero-length password.\n\n- Value: *keystore*\n- Tags:\n  - `jenkins:credentials:type` = `certificate`\n\n#### Example\n\nAWS CLI:\n\n```bash\nopenssl pkcs12 -export -in /path/to/cert.pem -inkey /path/to/key.pem -out certificate.p12 -passout pass:\naws secretsmanager create-secret --name 'code-signing-cert' --secret-binary 'fileb://certificate.p12' --tags 'Key=jenkins:credentials:type,Value=certificate' --description 'Acme Corp code signing certificate'\n```\n\nScripted Pipeline:\n\n```groovy\nnode {\n    withCredentials([certificate(credentialsId: 'code-signing-cert', keystoreVariable: 'STORE_FILE')]) {\n        echo 'Hello world'\n    }\n}\n```\n\n### Secret File\n\nA secret file with binary *content* and an optional *filename*.\n\n- Value: *content*\n- Tags:\n  - `jenkins:credentials:type` = `file`\n  - `jenkins:credentials:filename` = *filename* (optional)\n\nThe credential ID is used as the filename by default. In the rare cases when you need to override this (for example, if the credential ID would be an invalid filename on your filesystem), you can set the `jenkins:credentials:filename` tag.\n\n#### Example\n\nAWS CLI:\n\n```bash\necho -n $'\\x01\\x02\\x03' \u003e license.bin\naws secretsmanager create-secret --name 'license-key' --secret-binary 'fileb://license.bin' --tags 'Key=jenkins:credentials:type,Value=file' --description 'License key'\n```\n\nDeclarative Pipeline:\n\n```groovy\npipeline {\n    agent any\n    environment {\n        LICENSE_KEY_FILE = credentials('license-key')\n    }\n    stages {\n        stage('Example') {\n            steps {\n              echo 'Hello world'\n            }\n        }\n    }\n}\n```\n\nScripted Pipeline:\n\n```groovy\nnode {\n    withCredentials([file(credentialsId: 'license-key', variable: 'LICENSE_KEY_FILE')]) {\n        echo 'Hello world'\n    }\n}\n```\n\n## Advanced Usage\n\nYou may need to deal with multi-field credentials or vendor-specific credential types that the plugin does not (yet) support.\n\nIn this situation you have a couple of choices:\n\n- Use the closest standard multi-field credential (e.g. Username With Password) that fits your requirements.\n- Use a string credential, serialize all the fields into the secret value (e.g. as JSON or as a delimited string), and parse them in the job script. (This is a last resort when other methods don't work, e.g. when secret rotation would cause multiple fields to change.)\n\nExample: Jenkins authenticates to Secrets Manager using the primary AWS credential (from the environment). You have a job that performs a particular AWS operation in a different account, which uses a secondary AWS credential. You choose to encode the secondary AWS credential as JSON in the string credential `foo`:\n\n```groovy\nnode {\n    withCredentials([string(credentialsId: 'foo', variable: 'secret')]) {\n        script {\n            def creds = readJSON text: secret\n            env.AWS_ACCESS_KEY_ID = creds['accessKeyId']\n            env.AWS_SECRET_ACCESS_KEY = creds['secretAccessKey']\n            env.AWS_REGION = 'us-east-1' // or whatever\n        }\n        sh \"aws sts get-caller-identity\" // or whatever\n    }\n}\n```\n\n## Configuration\n\nThe plugin has a couple of **optional** settings to fine-tune its behavior. **In most installations you do not need to change these settings.** If you need to change the configuration, you can use the Web UI or CasC.\n\n### Web UI\n\nYou can set plugin configuration using the Web UI.\n\nGo to `Manage Jenkins` \u003e `Configure System` \u003e `AWS Secrets Manager Credentials Provider` and change the settings.\n\nAvailable settings:\n\n- [Cache](caching/index.md)\n- [Client](client/index.md)\n  - CredentialsProvider\n  - Endpoint Configuration\n  - Region\n- ListSecrets configuration\n  - [Filters](filters/index.md)\n- [Transformations](transformations/index.md)\n\n### Configuration As Code (CasC)\n\nYou can set plugin configuration using Jenkins [Configuration As Code](https://github.com/jenkinsci/configuration-as-code-plugin).\n\n**Schema:**\n\n```yaml\nunclassified:\n  awsCredentialsProvider:\n    cache: (boolean)                 # optional\n    client:                          # optional\n      credentialsProvider: (object)  # optional\n      endpointConfiguration:         # optional\n        serviceEndpoint: (URL)\n        signingRegion: (string)\n      region: (string)               # optional\n    listSecrets:                     # optional\n      filters:\n        - key: name\n          values:\n            - (string)\n        - key: tag-key\n          values:\n            - (string)\n        - key: tag-value\n          values:\n            - (string)\n        - key: description\n          values:\n            - (string)\n    transformations:           # optional\n      description:\n        hide: {}\n      name: (object)\n```\n\n## Versioning\n\nVersion tags for this plugin are of the format:\n\n```\n\u003cmajor\u003e.\u003cautogenerated\u003e\n```\n\nFor example `1.55.v0fcce24a_9501`.\n\nThe `\u003cmajor\u003e` prefix is incremented to indicate **breaking changes** in the plugin. When this happens, **please read the release notes and test the plugin extra carefully before deploying it to production.** To assist users of the Jenkins Update Center we will also add an `hpi.compatibleSinceVersion` annotation to the POM.\n\nThe `\u003cautogenerated\u003e` part is created by the Jenkins [automated plugin release](https://www.jenkins.io/doc/developer/publishing/releasing-cd) system. This is incremented on any non-breaking (minor) change, e.g. new features, bug fixes, or dependency updates. It should normally be safe to adopt these changes straight away.\n\n## Development\n\n### Git\n\nStart by cloning the project.\n\n**Note for Windows users:** some of the file paths in this project may exceed the legacy Win32 path length limit. This may cause an error when cloning the project on Windows. If you see this error, enable Git's Windows longpaths support with `git config --system core.longpaths true` (you might need to run Git as Administrator for this to work). Then try to clone the project again.\n\n### Dependencies\n\n- Docker\n- Java\n- Maven\n\n### Build \n\nIn Maven:\n\n```shell script\nmvn clean verify\n```\n\nIn your IDE:\n\n1. Generate translations: `mvn localizer:generate`. (This is a one-off task. You only need to re-run this if you change the translations, or if you clean the Maven `target` directory. If the IDE still cannot find the translation symbols after running `mvn localizer:generate`, use a one-off `mvn compile` instead.)\n2. Compile.\n3. Run tests.\n\n### Run\n\nYou can explore how the plugin works by running it locally with [Moto](https://github.com/getmoto/moto) (the AWS mock)...\n\nStart Moto:\n\n```shell\ndocker run -it -p 5000:5000 motoserver/moto:3.1.18\n```\n\nUpload some fake secrets to Moto (like these):\n\n```shell\naws --endpoint-url http://localhost:5000 secretsmanager create-secret --name 'example-api-key' --secret-string '123456' --tags 'Key=jenkins:credentials:type,Value=string' --description 'Example API key'\n```\n\nStart Jenkins with the plugin:\n\n```shell\nmvn hpi:run\n```\n\nEdit the plugin configuration at http://localhost:8080/jenkins/configure to use Moto:\n\n1. Enable the `Endpoint Configuration` option\n2. Set `Service Endpoint` to `http://localhost:5000\n3. Set `Signing Region` to `us-east-1`\n4. Click `Save`\n5. Try loading the Jenkins credentials that have come from Moto, or using them in Jenkins jobs.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fjenkinsci%2Faws-secrets-manager-credentials-provider-plugin","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fjenkinsci%2Faws-secrets-manager-credentials-provider-plugin","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fjenkinsci%2Faws-secrets-manager-credentials-provider-plugin/lists"}