{"id":15642732,"url":"https://github.com/lgallard/terraform-aws-secrets-manager","last_synced_at":"2026-01-01T23:31:10.381Z","repository":{"id":44735716,"uuid":"274989705","full_name":"lgallard/terraform-aws-secrets-manager","owner":"lgallard","description":"Terraform module to create Amazon Secrets Manager resources.","archived":false,"fork":false,"pushed_at":"2024-06-05T16:50:10.000Z","size":88,"stargazers_count":64,"open_issues_count":3,"forks_count":50,"subscribers_count":3,"default_branch":"master","last_synced_at":"2024-12-15T23:55:05.912Z","etag":null,"topics":["amazon-secrets-manager","aws","secret-management","secrets","terraform","terraform-module"],"latest_commit_sha":null,"homepage":"","language":"HCL","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/lgallard.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2020-06-25T18:38:51.000Z","updated_at":"2024-11-27T17:38:43.000Z","dependencies_parsed_at":"2024-06-05T17:13:17.526Z","dependency_job_id":"8228ce7d-adae-491a-9cac-c971c802013d","html_url":"https://github.com/lgallard/terraform-aws-secrets-manager","commit_stats":null,"previous_names":[],"tags_count":26,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lgallard%2Fterraform-aws-secrets-manager","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lgallard%2Fterraform-aws-secrets-manager/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lgallard%2Fterraform-aws-secrets-manager/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lgallard%2Fterraform-aws-secrets-manager/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/lgallard","download_url":"https://codeload.github.com/lgallard/terraform-aws-secrets-manager/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":230516192,"owners_count":18238353,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["amazon-secrets-manager","aws","secret-management","secrets","terraform","terraform-module"],"created_at":"2024-10-03T11:57:19.619Z","updated_at":"2025-12-28T07:05:14.698Z","avatar_url":"https://github.com/lgallard.png","language":"HCL","funding_links":[],"categories":[],"sub_categories":[],"readme":"![Terraform](https://lgallardo.com/images/terraform.jpg)\n# terraform-aws-secrets-manager\n\nTerraform module to create [Amazon Secrets Manager](https://aws.amazon.com/secrets-manager/) resources with comprehensive input validation and advanced features.\n\nAWS Secrets Manager helps you protect secrets needed to access your applications, services, and IT resources. The service enables you to easily rotate, manage, and retrieve database credentials, API keys, and other secrets throughout their lifecycle.\n\n## Features\n\n- ✅ **Input Validation**: Comprehensive validation for all variables to prevent configuration errors\n- ✅ **Type Safety**: Strongly typed variables with structured object definitions\n- ✅ **Secret Rotation**: Built-in support for automatic secret rotation with Lambda functions\n- ✅ **Cross-Region Replication**: Support for replicating secrets across AWS regions\n- ✅ **KMS Encryption**: Support for customer-managed KMS keys\n- ✅ **Resource Policies**: Attach custom IAM policies to secrets\n- ✅ **Flexible Secret Types**: Support for plain text, key/value pairs, and binary secrets\n\n## Examples\n\nCheck the [examples](/examples/) folder where you can see the complete compilation of snippets.\n\n## Basic Usage\n\n### Plain text secrets\n\n```hcl\nmodule \"secrets-manager-1\" {\n  source = \"lgallard/secrets-manager/aws\"\n\n  secrets = {\n    secret-1 = {\n      description             = \"My secret 1\"\n      recovery_window_in_days = 7\n      secret_string           = \"This is an example\"\n    },\n    secret-2 = {\n      description             = \"My secret 2\"\n      recovery_window_in_days = 7\n      secret_string           = \"This is another example\"\n    }\n  }\n\n  tags = {\n    Owner       = \"DevOps team\"\n    Environment = \"dev\"\n    Terraform   = true\n  }\n}\n```\n\n### Key/Value secrets\n\n```hcl\nmodule \"secrets-manager-2\" {\n  source = \"lgallard/secrets-manager/aws\"\n\n  secrets = {\n    secret-kv-1 = {\n      description = \"This is a key/value secret\"\n      secret_key_value = {\n        key1 = \"value1\"\n        key2 = \"value2\"\n      }\n      recovery_window_in_days = 7\n    },\n    secret-kv-2 = {\n      description = \"Another key/value secret\"\n      secret_key_value = {\n        username = \"user\"\n        password = \"topsecret\"\n      }\n      tags = {\n        app = \"web\"\n      }\n      recovery_window_in_days = 7\n    },\n  }\n\n  tags = {\n    Owner       = \"DevOps team\"\n    Environment = \"dev\"\n    Terraform   = true\n  }\n}\n```\n\n### Binary secrets\n\n```hcl\nmodule \"secrets-manager-3\" {\n  source = \"lgallard/secrets-manager/aws\"\n\n  secrets = {\n    secret-binary-1 = {\n      description   = \"This is a binary secret\"\n      secret_binary = \"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDt4TcI58h4G0wR+GcDY+0VJR10JNvG92jEKGaKxeMaOkfsXflVGsYXbfVBBCG/n3uHtTse7baYLB6LWQAuYWL1SHJVhhTQ7pPiocFWibAvJlVo1l7qJEDu2OxKpWEleCE+p3ufNXAy7v5UFO7EOnj0Zg6R3F/MiAWbQnaEHcYzNtogyC24YBecBLrBXZNi1g0AN1hM9k+3XvWUYTf9vPv8LIWnqo7y4Q2iEGWWurf37YFl1LzX4mG/Co+Vfe5TlZSe2YPMYWlw0ZKaKvwzInRR6dPMAflo3ABzlduiIbSdp110uGqB8i2M8eGXNDxR7Ni4nnLWnT9r1cpWhXWP6pAG4Xg8+x7+PIg/pgjgJNmsURw+jPD6+hkCw2Vz16EIgkC2b7lj0V6J4LncUoRzU/1sAzCQ4tspy3SKBUinYoxbDvXleF66FHEjfparnvNwfslBx0IJjG2uRwuX6zrsNIsGF1stEjz+eyAOtFV4/wRjRcCNDZvl1ODzIvwf8pAWddE= lgallard@server1\"\n      recovery_window_in_days = 7\n    },\n    secret-binary-2 = {\n      name                    = \"secret-binary-2\"\n      description             = \"Another binary secret\"\n      secret_binary           = \"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCzc818NSC6oJYnNjVWoF43+IuQpqc3WyS8BWZ50uawK5lY/aObweX2YiXPv2CoVvHUM0vG7U7BDBvNi2xwsT9n9uT27lcVQsTa8iDtpyoeBhcj3vJ60Jd04UfoMP7Og6UbD+KGiaqQ0LEtMXq6d3i619t7V0UkaJ4MXh2xl5y3bV4zNzTXdSScJnvMFfjLW0pJOOqltLma3NQ9ILVdMSK2Vzxc87T+h/jp0VuUAX4Rx9DqmxEU/4JadXmow/BKy69KVwAk/AQ8jL7OwD2YAxlMKqKnOsBJQF27YjmMD240UjkmnPlxkV8+g9b2hA0iM5GL+5MWg6pPUE0BYdarCmwyuaWYhv/426LnfHTz9UVC3y9Hg5c4X4I6AdJJUmarZXqxnMe9jJiqiQ+CAuxW3m0gIGsEbUul6raG73xFuozlaXq3J+kMCVW24eG2i5fezgmtiysIf/dpcUo+YLkX+U8jdMQg9IwCY0bf8XL39kwJ7u8uWU8+7nMcS9VQ5llVVMk= lgallard@server2\"\n      recovery_window_in_days = 7\n      tags = {\n        app = \"web\"\n      }\n    }\n  }\n\n  tags = {\n    Owner       = \"DevOps team\"\n    Environment = \"dev\"\n    Terraform   = true\n  }\n}\n```\n\n## Advanced Usage\n\n### Secrets with KMS Encryption\n\n```hcl\nmodule \"secrets-manager-kms\" {\n  source = \"lgallard/secrets-manager/aws\"\n\n  secrets = {\n    database-credentials = {\n      description = \"Database credentials encrypted with customer KMS key\"\n      secret_key_value = {\n        username = \"admin\"\n        password = \"super-secret-password\"\n        host     = \"db.example.com\"\n        port     = \"5432\"\n      }\n      kms_key_id              = \"arn:aws:kms:us-east-1:123456789012:key/12345678-1234-1234-1234-123456789012\"\n      recovery_window_in_days = 7\n    }\n  }\n\n  tags = {\n    Environment = \"production\"\n    KMSEncrypted = \"true\"\n  }\n}\n```\n\n### Secrets with Resource Policies\n\n```hcl\ndata \"aws_iam_policy_document\" \"secret_policy\" {\n  statement {\n    sid    = \"AllowApplicationAccess\"\n    effect = \"Allow\"\n    \n    principals {\n      type        = \"AWS\"\n      identifiers = [\"arn:aws:iam::123456789012:role/MyApplicationRole\"]\n    }\n    \n    actions   = [\"secretsmanager:GetSecretValue\"]\n    resources = [\"*\"]\n  }\n}\n\nmodule \"secrets-manager-policy\" {\n  source = \"lgallard/secrets-manager/aws\"\n\n  secrets = {\n    app-config = {\n      description   = \"Application configuration with resource policy\"\n      secret_string = jsonencode({\n        api_key = \"secret-api-key\"\n        config  = \"production-config\"\n      })\n      policy                  = data.aws_iam_policy_document.secret_policy.json\n      recovery_window_in_days = 14\n    }\n  }\n}\n```\n\n### Cross-Region Secret Replication\n\n```hcl\nmodule \"secrets-manager-replication\" {\n  source = \"lgallard/secrets-manager/aws\"\n\n  secrets = {\n    global-config = {\n      description   = \"Global configuration replicated across regions\"\n      secret_string = \"global-configuration-data\"\n      \n      replica_regions = {\n        \"us-west-2\" = \"arn:aws:kms:us-west-2:123456789012:key/12345678-1234-1234-1234-123456789012\"\n        \"eu-west-1\" = \"arn:aws:kms:eu-west-1:123456789012:key/87654321-4321-4321-4321-210987654321\"\n      }\n      \n      force_overwrite_replica_secret = true\n      recovery_window_in_days        = 7\n    }\n  }\n\n  tags = {\n    ReplicationEnabled = \"true\"\n    GlobalResource     = \"true\"\n  }\n}\n```\n\n### Lifecycle Configuration\n\nIf you need to configure lifecycle rules for your secrets (such as `prevent_destroy`, `create_before_destroy`, or `ignore_changes`), you must configure them on individual resources since lifecycle blocks cannot be used with module calls.\n\nHere are the recommended approaches:\n\n#### Option 1: Create secrets directly with lifecycle rules\n\n```hcl\n# Create secret directly with lifecycle protection\nresource \"aws_secretsmanager_secret\" \"critical_secret\" {\n  name        = \"critical-database-password\"\n  description = \"Critical database password - protected from accidental deletion\"\n\n  lifecycle {\n    prevent_destroy = true\n  }\n\n  tags = {\n    Environment = \"production\"\n    Critical    = \"true\"\n  }\n}\n\nresource \"aws_secretsmanager_secret_version\" \"critical_secret_version\" {\n  secret_id     = aws_secretsmanager_secret.critical_secret.id\n  secret_string = \"super-secret-password\"\n\n  lifecycle {\n    ignore_changes = [secret_string]\n  }\n}\n```\n\n#### Option 2: Use module alongside protected resources\n\n```hcl\n# Use module for convenience, then protect specific secrets separately\nmodule \"secrets-manager\" {\n  source = \"lgallard/secrets-manager/aws\"\n\n  secrets = {\n    app-config = {\n      description   = \"Application configuration\"\n      secret_string = \"app-configuration-data\"\n    }\n  }\n}\n\n# Create additional protected secret with lifecycle rules\nresource \"aws_secretsmanager_secret\" \"protected_secret\" {\n  name        = \"critical-database-password\"\n  description = \"Critical database password - protected from accidental deletion\"\n\n  lifecycle {\n    prevent_destroy       = true\n    create_before_destroy = true\n  }\n\n  tags = {\n    Environment = \"production\"\n    Critical    = \"true\"\n  }\n}\n\nresource \"aws_secretsmanager_secret_version\" \"protected_version\" {\n  secret_id     = aws_secretsmanager_secret.protected_secret.id\n  secret_string = \"super-secret-password\"\n\n  lifecycle {\n    ignore_changes = [secret_string]\n  }\n}\n```\n\nThis approach follows Terraform's requirement that lifecycle blocks only contain literal values and can only be used on resource blocks, not module calls.\n\n## Secrets Rotation\n\nIf you need to rotate your secrets, use `rotate_secrets` map to define them. The lambda function must exist and have the right permissions to rotate secrets in AWS Secrets Manager:\n\n```hcl\nmodule \"secrets-manager-rotation\" {\n  source = \"lgallard/secrets-manager/aws\"\n\n  rotate_secrets = {\n    database-password = {\n      description             = \"Database password rotated every 30 days\"\n      secret_string           = \"initial-password\"\n      rotation_lambda_arn     = \"arn:aws:lambda:us-east-1:123456789012:function:rotate-secret\"\n      automatically_after_days = 30\n      recovery_window_in_days = 15\n    },\n    api-key = {\n      description             = \"API key rotated weekly\"\n      secret_string           = \"initial-api-key\"\n      rotation_lambda_arn     = \"arn:aws:lambda:us-east-1:123456789012:function:rotate-secret\"\n      automatically_after_days = 7\n      recovery_window_in_days = 7\n    }\n  }\n\n  tags = {\n    Owner       = \"DevOps team\"\n    Environment = \"dev\"\n    Terraform   = true\n  }\n}\n\n# Lambda function for rotation (example)\n# AWS templates available at https://github.com/aws-samples/aws-secrets-manager-rotation-lambdas\nmodule \"rotate_secret_lambda\" {\n  source  = \"spring-media/lambda/aws\"\n  version = \"5.2.0\"\n\n  filename         = \"secrets_manager_rotation.zip\"\n  function_name    = \"rotate-secret\"\n  handler          = \"secrets_manager_rotation.lambda_handler\"\n  runtime          = \"python3.9\"\n  source_code_hash = filebase64sha256(\"${path.module}/secrets_manager_rotation.zip\")\n\n  environment = {\n    variables = {\n      SECRETS_MANAGER_ENDPOINT = \"https://secretsmanager.us-east-1.amazonaws.com\"\n    }\n  }\n}\n\nresource \"aws_lambda_permission\" \"allow_secret_manager_call_lambda\" {\n  function_name = module.rotate_secret_lambda.function_name\n  statement_id  = \"AllowExecutionSecretManager\"\n  action        = \"lambda:InvokeFunction\"\n  principal     = \"secretsmanager.amazonaws.com\"\n}\n```\n\n## Mixed Secret Definitions\n\nYou can define different types of secrets (string, key/value, or binary) in the same `secrets` or `rotate_secrets` map:\n\n```hcl\nmodule \"secrets-manager-mixed\" {\n  source = \"lgallard/secrets-manager/aws\"\n\n  secrets = {\n    plain-text-secret = {\n      description             = \"A plain text secret\"\n      recovery_window_in_days = 7\n      secret_string           = \"This is a plain text secret\"\n    }\n    \n    key-value-secret = {\n      description = \"A key/value secret for database credentials\"\n      secret_key_value = {\n        username = \"dbuser\"\n        password = \"dbpassword\"\n        host     = \"database.example.com\"\n        port     = \"5432\"\n        database = \"myapp\"\n      }\n      recovery_window_in_days = 14\n      tags = {\n        Type = \"database\"\n      }\n    }\n    \n    binary-secret = {\n      description   = \"SSH private key\"\n      secret_binary = \"-----BEGIN PRIVATE KEY-----\\nMIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQC...\"\n      recovery_window_in_days = 30\n      tags = {\n        Type = \"ssh-key\"\n      }\n    }\n  }\n\n  tags = {\n    Owner       = \"DevOps team\"\n    Environment = \"dev\"\n    Terraform   = true\n  }\n}\n```\n\n## Input Validation Reference\n\nThis module includes comprehensive input validation to prevent configuration errors:\n\n### Secret Names\n- Must contain only alphanumeric characters, hyphens, underscores, periods, forward slashes, at signs, plus signs, and equal signs\n- Must be between 1 and 512 characters long\n- Examples: `my-secret`, `app/config`, `db_credentials`\n\n### Recovery Window\n- Must be 0 (immediate deletion) or between 7-30 days\n- Default: 30 days\n\n### Rotation Frequency  \n- Must be between 1-365 days for `automatically_after_days`\n- Default: 30 days\n\n### Version Stages\n- Only `AWSCURRENT` and `AWSPENDING` are valid\n- Example: `[\"AWSCURRENT\"]`\n\n### KMS Key IDs\n- Must be valid KMS key ARN, alias, or key ID format\n- Examples:\n  - ARN: `arn:aws:kms:us-east-1:123456789012:key/12345678-1234-1234-1234-123456789012`\n  - Alias: `alias/my-key`\n  - Key ID: `12345678-1234-1234-1234-123456789012`\n\n### Tags\n- Keys cannot start with `aws:` (case insensitive)\n- Keys must be 1-128 characters long\n- Values must be 256 characters or less\n\n## Troubleshooting\n\n### Common Issues and Solutions\n\n#### Invalid Secret Name Error\n```\nError: Secret names must contain only alphanumeric characters, hyphens, underscores, periods, forward slashes, at signs, plus signs, and equal signs.\n```\n**Solution**: Check your secret names for invalid characters. Only use: `a-z`, `A-Z`, `0-9`, `-`, `_`, `.`, `/`, `@`, `+`, `=`\n\n#### Recovery Window Validation Error\n```\nError: Recovery window must be 0 (for immediate deletion) or between 7 and 30 days.\n```\n**Solution**: Set `recovery_window_in_days` to either `0` or a value between `7` and `30`.\n\n#### KMS Key Format Error\n```\nError: KMS key ID must be a valid KMS key ARN, alias, or key ID format.\n```\n**Solution**: Ensure your KMS key follows one of these formats:\n- `arn:aws:kms:region:account:key/key-id`\n- `alias/key-alias`\n- `key-id` (UUID format)\n\n#### Rotation Lambda Missing Error\n```\nError: All rotate_secrets must have a valid rotation_lambda_arn specified.\n```\n**Solution**: When using `rotate_secrets`, always provide a valid `rotation_lambda_arn`. The Lambda function must exist and have proper permissions.\n\n#### Tag Validation Error\n```\nError: Tag keys cannot start with 'aws:' (case insensitive).\n```\n**Solution**: Remove any tags that start with `aws:`, `AWS:`, or any case variation.\n\n### Performance Considerations\n\n1. **Large Numbers of Secrets**: If you have many secrets, consider splitting them across multiple module instances to improve Terraform performance.\n\n2. **Cross-Region Replication**: Be aware that replication increases costs and may impact performance. Only replicate secrets that truly need global availability.\n\n3. **Rotation Frequency**: More frequent rotations increase Lambda costs and API calls. Balance security requirements with operational costs.\n\n### Security Best Practices\n\n1. **Least Privilege Access**: Use resource policies to grant minimal required permissions.\n\n2. **Encryption**: Always use KMS encryption for sensitive secrets, preferably with customer-managed keys.\n\n3. **Monitoring**: Enable CloudTrail logging for Secrets Manager API calls to monitor access patterns.\n\n4. **Rotation**: Implement regular rotation for database credentials and API keys.\n\n5. **Version Management**: Use version stages appropriately and avoid storing multiple active versions unnecessarily.\n\n## Version 0.5.0+ breaking changes\nIssue [#13](https://github.com/lgallard/terraform-aws-secrets-manager/issues/13) highlighted the fact that changing the secrets order will recreate the secrets (for example, adding a new secret in the top of the list o removing a secret that is not the last one). The suggested approach to tackle this issue was to use `for_each` to iterate over a map of secrets.\n\nVersion 0.5.0 has this implementation, but it's not backward compatible. Therefore you must migrate your Terraform code and the objects in the tfstate.\n\n### Migrating the code:\n\nBefore 0.5.0 your secrets were defined as list as follow:\n\n```\n  secrets = [\n    {\n      name                    = \"secret-1\"\n      description             = \"My secret 1\"\n      recovery_window_in_days = 7\n      secret_string           = \"This is an example\"\n    },\n  ]\n\n```\n\nAfter version 0.5.0 you have to define you secrets as a map:\n\n```\n  secrets = {\n    secret-1 = {\n      description             = \"My secret 1\"\n      recovery_window_in_days = 7\n      secret_string           = \"This is an example\"\n    },\n  }\n```\n\nNotice that the map key is the name of the secret, thefore a `name` field is not needed anymore.\n\n### Migrating the objects in the tfstate file\n\nTo avoid recreating your already deploy secrets you can rename or move the object in the tfstate file as follow:\n\n```\nterraform state mv 'module.secrets-manager-1.aws_secretsmanager_secret_version.sm-sv['0']' 'module.secrets-manager-1.aws_secretsmanager_secret_version.sm-sv[\"secret-1\"]'\n```\n\nAnother option is to use a script to iterate over your secrets. In the [migration-scripts](/examples/migration-scripts) folder you'll find a couple of scripts that can be used as a starting point.\n\nFor example, to migrate a module named `secrets-manager-1` run the script as follow:\n\n```\n$ ./secret_list_to_map.sh secrets-manager-1\n\nMove \"module.secrets-manager-1.aws_secretsmanager_secret.sm[0]\" to \"module.secrets-manager-1.aws_secretsmanager_secret.sm[\\\"secret-1\\\"]\"\nSuccessfully moved 1 object(s).\nMove \"module.secrets-manager-1.aws_secretsmanager_secret_version.sm-sv[0]\" to \"module.secrets-manager-1.aws_secretsmanager_secret_version.sm-sv[\\\"secret-1\\\"]\"\nSuccessfully moved 1 object(s).\nMove \"module.secrets-manager-1.aws_secretsmanager_secret.sm[1]\" to \"module.secrets-manager-1.aws_secretsmanager_secret.sm[\\\"secret-2\\\"]\"\nSuccessfully moved 1 object(s).\nMove \"module.secrets-manager-1.aws_secretsmanager_secret_version.sm-sv[1]\" to \"module.secrets-manager-1.aws_secretsmanager_secret_version.sm-sv[\\\"secret-2\\\"]\"\nSuccessfully moved 1 object(s).\n\n```\n\n\u003c!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK --\u003e\n## Requirements\n\n| Name | Version |\n|------|---------|\n| \u003ca name=\"requirement_terraform\"\u003e\u003c/a\u003e [terraform](#requirement\\_terraform) | \u003e= 1.11.0 |\n| \u003ca name=\"requirement_aws\"\u003e\u003c/a\u003e [aws](#requirement\\_aws) | \u003e= 2.67.0 |\n\n## Providers\n\n| Name | Version |\n|------|---------|\n| \u003ca name=\"provider_aws\"\u003e\u003c/a\u003e [aws](#provider\\_aws) | 6.4.0 |\n\n## Modules\n\nNo modules.\n\n## Resources\n\n| Name | Type |\n|------|------|\n| [aws_secretsmanager_secret.rsm](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/secretsmanager_secret) | resource |\n| [aws_secretsmanager_secret.sm](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/secretsmanager_secret) | resource |\n| [aws_secretsmanager_secret_rotation.rsm-sr](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/secretsmanager_secret_rotation) | resource |\n| [aws_secretsmanager_secret_version.rsm-sv](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/secretsmanager_secret_version) | resource |\n| [aws_secretsmanager_secret_version.rsm-svu](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/secretsmanager_secret_version) | resource |\n| [aws_secretsmanager_secret_version.sm-sv](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/secretsmanager_secret_version) | resource |\n| [aws_secretsmanager_secret_version.sm-svu](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/secretsmanager_secret_version) | resource |\n\n## Inputs\n\n| Name | Description | Type | Default | Required |\n|------|-------------|------|---------|:--------:|\n| \u003ca name=\"input_automatically_after_days\"\u003e\u003c/a\u003e [automatically\\_after\\_days](#input\\_automatically\\_after\\_days) | Specifies the number of days between automatic scheduled rotations of the secret. Must be between 1 and 365 days. Example: 30 | `number` | `30` | no |\n| \u003ca name=\"input_ephemeral\"\u003e\u003c/a\u003e [ephemeral](#input\\_ephemeral) | Enable ephemeral resources and write-only arguments to prevent sensitive data from being stored in state. Requires Terraform \u003e= 1.11. When enabled, secret values use write-only arguments (\\_wo) and are not persisted to state. Example: true | `bool` | `false` | no |\n| \u003ca name=\"input_recovery_window_in_days\"\u003e\u003c/a\u003e [recovery\\_window\\_in\\_days](#input\\_recovery\\_window\\_in\\_days) | Specifies the number of days that AWS Secrets Manager waits before it can delete the secret. This value can be 0 to force deletion without recovery or range from 7 to 30 days. Example: 7 | `number` | `30` | no |\n| \u003ca name=\"input_rotate_secrets\"\u003e\u003c/a\u003e [rotate\\_secrets](#input\\_rotate\\_secrets) | Map of secrets to keep and rotate in AWS Secrets Manager. Each secret must include rotation\\_lambda\\_arn. Example: { mysecret = { description = \"My secret\", secret\\_string = \"secret-value\", rotation\\_lambda\\_arn = \"arn:aws:lambda:us-east-1:123456789012:function:my-function\" } } | `any` | `{}` | no |\n| \u003ca name=\"input_secrets\"\u003e\u003c/a\u003e [secrets](#input\\_secrets) | Map of secrets to keep in AWS Secrets Manager. Example: { mysecret = { description = \"My secret\", secret\\_string = \"secret-value\" } } | `any` | `{}` | no |\n| \u003ca name=\"input_tags\"\u003e\u003c/a\u003e [tags](#input\\_tags) | Key-value map of user-defined tags attached to the secret. Keys cannot start with 'aws:'. Example: { Environment = \"prod\", Owner = \"team\" } | `any` | `{}` | no |\n| \u003ca name=\"input_unmanaged\"\u003e\u003c/a\u003e [unmanaged](#input\\_unmanaged) | Terraform must ignore secrets lifecycle. Using this option you can initialize the secrets and rotate them outside Terraform, avoiding other users changing or rotating secrets by subsequent Terraform runs. Example: true | `bool` | `false` | no |\n| \u003ca name=\"input_version_stages\"\u003e\u003c/a\u003e [version\\_stages](#input\\_version\\_stages) | List of version stages to be handled. Valid values are 'AWSCURRENT' and 'AWSPENDING'. Kept as null for backwards compatibility. Example: [\"AWSCURRENT\"] | `list(string)` | `null` | no |\n\n## Outputs\n\n| Name | Description |\n|------|-------------|\n| \u003ca name=\"output_rotate_secret_arns\"\u003e\u003c/a\u003e [rotate\\_secret\\_arns](#output\\_rotate\\_secret\\_arns) | Map of rotating secret names to their ARNs. Use these ARNs to grant permissions or reference rotating secrets in IAM policies and other AWS resources. |\n| \u003ca name=\"output_rotate_secret_ids\"\u003e\u003c/a\u003e [rotate\\_secret\\_ids](#output\\_rotate\\_secret\\_ids) | Map of rotating secret names to their resource IDs. Use these IDs to reference rotating secrets in other Terraform resources. |\n| \u003ca name=\"output_secret_arns\"\u003e\u003c/a\u003e [secret\\_arns](#output\\_secret\\_arns) | Map of secret names to their ARNs. Use these ARNs to grant permissions or reference secrets in IAM policies and other AWS resources. |\n| \u003ca name=\"output_secret_ids\"\u003e\u003c/a\u003e [secret\\_ids](#output\\_secret\\_ids) | Map of secret names to their resource IDs. Use these IDs to reference secrets in other Terraform resources. |\n\u003c!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK --\u003e\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Flgallard%2Fterraform-aws-secrets-manager","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Flgallard%2Fterraform-aws-secrets-manager","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Flgallard%2Fterraform-aws-secrets-manager/lists"}