{"id":14957932,"url":"https://github.com/terraform-aws-modules/terraform-aws-secrets-manager","last_synced_at":"2025-04-13T06:41:37.374Z","repository":{"id":181064330,"uuid":"665958714","full_name":"terraform-aws-modules/terraform-aws-secrets-manager","owner":"terraform-aws-modules","description":"Terraform module to create AWS Secrets Manager resources 🇺🇦","archived":false,"fork":false,"pushed_at":"2024-10-11T17:13:20.000Z","size":40,"stargazers_count":34,"open_issues_count":1,"forks_count":28,"subscribers_count":2,"default_branch":"master","last_synced_at":"2025-03-26T23:08:33.060Z","etag":null,"topics":["aws","aws-secrets-manager","secrets-manager","terraform","terraform-module","terraform-modules"],"latest_commit_sha":null,"homepage":"https://registry.terraform.io/modules/terraform-aws-modules/secrets-manager/aws","language":"HCL","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/terraform-aws-modules.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null},"funding":{"github":["antonbabenko"],"custom":"https://www.paypal.me/antonbabenko"}},"created_at":"2023-07-13T11:35:54.000Z","updated_at":"2025-02-24T20:57:16.000Z","dependencies_parsed_at":"2024-09-22T04:30:26.874Z","dependency_job_id":"1dacb35a-eb9e-46c4-a30e-0620f62b38c5","html_url":"https://github.com/terraform-aws-modules/terraform-aws-secrets-manager","commit_stats":{"total_commits":10,"total_committers":3,"mean_commits":"3.3333333333333335","dds":0.4,"last_synced_commit":"6e549c20f5fe6f8b4f8c36499d1e2455ee3d695b"},"previous_names":["clowdhaus/terraform-aws-secrets-manager","terraform-aws-modules/terraform-aws-secrets-manager"],"tags_count":6,"template":false,"template_full_name":"clowdhaus/terraform-aws-module-template","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/terraform-aws-modules%2Fterraform-aws-secrets-manager","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/terraform-aws-modules%2Fterraform-aws-secrets-manager/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/terraform-aws-modules%2Fterraform-aws-secrets-manager/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/terraform-aws-modules%2Fterraform-aws-secrets-manager/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/terraform-aws-modules","download_url":"https://codeload.github.com/terraform-aws-modules/terraform-aws-secrets-manager/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":248675434,"owners_count":21143763,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["aws","aws-secrets-manager","secrets-manager","terraform","terraform-module","terraform-modules"],"created_at":"2024-09-24T13:15:50.890Z","updated_at":"2025-04-13T06:41:37.352Z","avatar_url":"https://github.com/terraform-aws-modules.png","language":"HCL","funding_links":["https://github.com/sponsors/antonbabenko","https://www.paypal.me/antonbabenko"],"categories":[],"sub_categories":[],"readme":"# AWS Secrets Manager Terraform module\n\nTerraform module which creates AWS Secrets Manager resources.\n\n[![SWUbanner](https://raw.githubusercontent.com/vshymanskyy/StandWithUkraine/main/banner2-direct.svg)](https://github.com/vshymanskyy/StandWithUkraine/blob/main/docs/README.md)\n\n## Usage\n\nSee [`examples`](https://github.com/terraform-aws-modules/terraform-aws-secrets-manager/tree/master/examples) directory for working examples to reference:\n\n### Standard\n\n```hcl\nmodule \"secrets_manager\" {\n  source = \"terraform-aws-modules/secrets-manager/aws\"\n\n  # Secret\n  name_prefix             = \"example\"\n  description             = \"Example Secrets Manager secret\"\n  recovery_window_in_days = 30\n\n  # Policy\n  create_policy       = true\n  block_public_policy = true\n  policy_statements = {\n    read = {\n      sid = \"AllowAccountRead\"\n      principals = [{\n        type        = \"AWS\"\n        identifiers = [\"arn:aws:iam::1234567890:root\"]\n      }]\n      actions   = [\"secretsmanager:GetSecretValue\"]\n      resources = [\"*\"]\n    }\n  }\n\n  # Version\n  create_random_password           = true\n  random_password_length           = 64\n  random_password_override_special = \"!@#$%^\u0026*()_+\"\n\n  tags = {\n    Environment = \"Development\"\n    Project     = \"Example\"\n  }\n}\n```\n\n### w/ Rotation\n\n```hcl\nmodule \"secrets_manager\" {\n  source = \"terraform-aws-modules/secrets-manager/aws\"\n\n  # Secret\n  name_prefix             = \"rotated-example\"\n  description             = \"Rotated example Secrets Manager secret\"\n  recovery_window_in_days = 7\n\n  # Policy\n  create_policy       = true\n  block_public_policy = true\n  policy_statements = {\n    lambda = {\n      sid = \"LambdaReadWrite\"\n      principals = [{\n        type        = \"AWS\"\n        identifiers = [\"arn:aws:iam:1234567890:role/lambda-function\"]\n      }]\n      actions = [\n        \"secretsmanager:DescribeSecret\",\n        \"secretsmanager:GetSecretValue\",\n        \"secretsmanager:PutSecretValue\",\n        \"secretsmanager:UpdateSecretVersionStage\",\n      ]\n      resources = [\"*\"]\n    }\n    read = {\n      sid = \"AllowAccountRead\"\n      principals = [{\n        type        = \"AWS\"\n        identifiers = [\"arn:aws:iam::1234567890:root\"]\n      }]\n      actions   = [\"secretsmanager:DescribeSecret\"]\n      resources = [\"*\"]\n    }\n  }\n\n  # Version\n  ignore_secret_changes = true\n  secret_string = jsonencode({\n    engine   = \"mariadb\",\n    host     = \"mydb.cluster-123456789012.us-east-1.rds.amazonaws.com\",\n    username = \"Bill\",\n    password = \"Initial\"\n    dbname   = \"ThisIsMySuperSecretString12356!\u0026*()\",\n    port     = 3306\n  })\n\n  # Rotation\n  enable_rotation     = true\n  rotation_lambda_arn = \"arn:aws:lambda:us-east-1:123456789012:function:my-function\"\n  rotation_rules = {\n    # This should be more sensible in production\n    schedule_expression = \"rate(1 minute)\"\n  }\n\n  tags = {\n    Environment = \"Development\"\n    Project     = \"Example\"\n  }\n}\n```\n\n## Examples\n\nExamples codified under the [`examples`](https://github.com/terraform-aws-modules/terraform-aws-secrets-manager/tree/master/examples) are intended to give users references for how to use the module(s) as well as testing/validating changes to the source code of the module. If contributing to the project, please be sure to make any appropriate updates to the relevant examples to allow maintainers to test your changes and to keep the examples up to date for users. Thank you!\n\n- [Complete](https://github.com/terraform-aws-modules/terraform-aws-secrets-manager/tree/master/examples/complete)\n\n\u003c!-- BEGIN_TF_DOCS --\u003e\n## Requirements\n\n| Name | Version |\n|------|---------|\n| \u003ca name=\"requirement_terraform\"\u003e\u003c/a\u003e [terraform](#requirement\\_terraform) | \u003e= 1.0 |\n| \u003ca name=\"requirement_aws\"\u003e\u003c/a\u003e [aws](#requirement\\_aws) | \u003e= 5.0 |\n| \u003ca name=\"requirement_random\"\u003e\u003c/a\u003e [random](#requirement\\_random) | \u003e= 3.0 |\n\n## Providers\n\n| Name | Version |\n|------|---------|\n| \u003ca name=\"provider_aws\"\u003e\u003c/a\u003e [aws](#provider\\_aws) | \u003e= 5.0 |\n| \u003ca name=\"provider_random\"\u003e\u003c/a\u003e [random](#provider\\_random) | \u003e= 3.0 |\n\n## Modules\n\nNo modules.\n\n## Resources\n\n| Name | Type |\n|------|------|\n| [aws_secretsmanager_secret.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/secretsmanager_secret) | resource |\n| [aws_secretsmanager_secret_policy.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/secretsmanager_secret_policy) | resource |\n| [aws_secretsmanager_secret_rotation.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/secretsmanager_secret_rotation) | resource |\n| [aws_secretsmanager_secret_version.ignore_changes](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/secretsmanager_secret_version) | resource |\n| [aws_secretsmanager_secret_version.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/secretsmanager_secret_version) | resource |\n| [random_password.this](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/password) | resource |\n| [aws_iam_policy_document.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |\n\n## Inputs\n\n| Name | Description | Type | Default | Required |\n|------|-------------|------|---------|:--------:|\n| \u003ca name=\"input_block_public_policy\"\u003e\u003c/a\u003e [block\\_public\\_policy](#input\\_block\\_public\\_policy) | Makes an optional API call to Zelkova to validate the Resource Policy to prevent broad access to your secret | `bool` | `null` | no |\n| \u003ca name=\"input_create\"\u003e\u003c/a\u003e [create](#input\\_create) | Determines whether resources will be created (affects all resources) | `bool` | `true` | no |\n| \u003ca name=\"input_create_policy\"\u003e\u003c/a\u003e [create\\_policy](#input\\_create\\_policy) | Determines whether a policy will be created | `bool` | `false` | no |\n| \u003ca name=\"input_create_random_password\"\u003e\u003c/a\u003e [create\\_random\\_password](#input\\_create\\_random\\_password) | Determines whether a random password will be generated | `bool` | `false` | no |\n| \u003ca name=\"input_description\"\u003e\u003c/a\u003e [description](#input\\_description) | A description of the secret | `string` | `null` | no |\n| \u003ca name=\"input_enable_rotation\"\u003e\u003c/a\u003e [enable\\_rotation](#input\\_enable\\_rotation) | Determines whether secret rotation is enabled | `bool` | `false` | no |\n| \u003ca name=\"input_force_overwrite_replica_secret\"\u003e\u003c/a\u003e [force\\_overwrite\\_replica\\_secret](#input\\_force\\_overwrite\\_replica\\_secret) | Accepts boolean value to specify whether to overwrite a secret with the same name in the destination Region | `bool` | `null` | no |\n| \u003ca name=\"input_ignore_secret_changes\"\u003e\u003c/a\u003e [ignore\\_secret\\_changes](#input\\_ignore\\_secret\\_changes) | Determines whether or not Terraform will ignore changes made externally to `secret_string` or `secret_binary`. Changing this value after creation is a destructive operation | `bool` | `false` | no |\n| \u003ca name=\"input_kms_key_id\"\u003e\u003c/a\u003e [kms\\_key\\_id](#input\\_kms\\_key\\_id) | ARN or Id of the AWS KMS key to be used to encrypt the secret values in the versions stored in this secret. If you need to reference a CMK in a different account, you can use only the key ARN. If you don't specify this value, then Secrets Manager defaults to using the AWS account's default KMS key (the one named `aws/secretsmanager` | `string` | `null` | no |\n| \u003ca name=\"input_name\"\u003e\u003c/a\u003e [name](#input\\_name) | Friendly name of the new secret. The secret name can consist of uppercase letters, lowercase letters, digits, and any of the following characters: `/_+=.@-` | `string` | `null` | no |\n| \u003ca name=\"input_name_prefix\"\u003e\u003c/a\u003e [name\\_prefix](#input\\_name\\_prefix) | Creates a unique name beginning with the specified prefix | `string` | `null` | no |\n| \u003ca name=\"input_override_policy_documents\"\u003e\u003c/a\u003e [override\\_policy\\_documents](#input\\_override\\_policy\\_documents) | List of IAM policy documents that are merged together into the exported document. In merging, statements with non-blank `sid`s will override statements with the same `sid` | `list(string)` | `[]` | no |\n| \u003ca name=\"input_policy_statements\"\u003e\u003c/a\u003e [policy\\_statements](#input\\_policy\\_statements) | A map of IAM policy [statements](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document#statement) for custom permission usage | `map(any)` | `{}` | no |\n| \u003ca name=\"input_random_password_length\"\u003e\u003c/a\u003e [random\\_password\\_length](#input\\_random\\_password\\_length) | The length of the generated random password | `number` | `32` | no |\n| \u003ca name=\"input_random_password_override_special\"\u003e\u003c/a\u003e [random\\_password\\_override\\_special](#input\\_random\\_password\\_override\\_special) | Supply your own list of special characters to use for string generation. This overrides the default character list in the special argument | `string` | `\"!@#$%\u0026*()-_=+[]{}\u003c\u003e:?\"` | no |\n| \u003ca name=\"input_recovery_window_in_days\"\u003e\u003c/a\u003e [recovery\\_window\\_in\\_days](#input\\_recovery\\_window\\_in\\_days) | Number of days that AWS Secrets Manager waits before it can delete the secret. This value can be `0` to force deletion without recovery or range from `7` to `30` days. The default value is `30` | `number` | `null` | no |\n| \u003ca name=\"input_replica\"\u003e\u003c/a\u003e [replica](#input\\_replica) | Configuration block to support secret replication | `map(any)` | `{}` | no |\n| \u003ca name=\"input_rotation_lambda_arn\"\u003e\u003c/a\u003e [rotation\\_lambda\\_arn](#input\\_rotation\\_lambda\\_arn) | Specifies the ARN of the Lambda function that can rotate the secret | `string` | `\"\"` | no |\n| \u003ca name=\"input_rotation_rules\"\u003e\u003c/a\u003e [rotation\\_rules](#input\\_rotation\\_rules) | A structure that defines the rotation configuration for this secret | `map(any)` | `{}` | no |\n| \u003ca name=\"input_secret_binary\"\u003e\u003c/a\u003e [secret\\_binary](#input\\_secret\\_binary) | Specifies binary data that you want to encrypt and store in this version of the secret. This is required if `secret_string` is not set. Needs to be encoded to base64 | `string` | `null` | no |\n| \u003ca name=\"input_secret_string\"\u003e\u003c/a\u003e [secret\\_string](#input\\_secret\\_string) | Specifies text data that you want to encrypt and store in this version of the secret. This is required if `secret_binary` is not set | `string` | `null` | no |\n| \u003ca name=\"input_source_policy_documents\"\u003e\u003c/a\u003e [source\\_policy\\_documents](#input\\_source\\_policy\\_documents) | List of IAM policy documents that are merged together into the exported document. Statements must have unique `sid`s | `list(string)` | `[]` | no |\n| \u003ca name=\"input_tags\"\u003e\u003c/a\u003e [tags](#input\\_tags) | A map of tags to add to all resources | `map(string)` | `{}` | no |\n| \u003ca name=\"input_version_stages\"\u003e\u003c/a\u003e [version\\_stages](#input\\_version\\_stages) | Specifies a list of staging labels that are attached to this version of the secret. A staging label must be unique to a single version of the secret | `list(string)` | `null` | no |\n\n## Outputs\n\n| Name | Description |\n|------|-------------|\n| \u003ca name=\"output_secret_arn\"\u003e\u003c/a\u003e [secret\\_arn](#output\\_secret\\_arn) | The ARN of the secret |\n| \u003ca name=\"output_secret_binary\"\u003e\u003c/a\u003e [secret\\_binary](#output\\_secret\\_binary) | The secret binary |\n| \u003ca name=\"output_secret_id\"\u003e\u003c/a\u003e [secret\\_id](#output\\_secret\\_id) | The ID of the secret |\n| \u003ca name=\"output_secret_name\"\u003e\u003c/a\u003e [secret\\_name](#output\\_secret\\_name) | The name of the secret |\n| \u003ca name=\"output_secret_replica\"\u003e\u003c/a\u003e [secret\\_replica](#output\\_secret\\_replica) | Attributes of the replica created |\n| \u003ca name=\"output_secret_string\"\u003e\u003c/a\u003e [secret\\_string](#output\\_secret\\_string) | The secret string |\n| \u003ca name=\"output_secret_version_id\"\u003e\u003c/a\u003e [secret\\_version\\_id](#output\\_secret\\_version\\_id) | The unique identifier of the version of the secret |\n\u003c!-- END_TF_DOCS --\u003e\n\n## License\n\nApache-2.0 Licensed. See [LICENSE](https://github.com/terraform-aws-modules/terraform-aws-secrets-manager/blob/master/LICENSE).\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fterraform-aws-modules%2Fterraform-aws-secrets-manager","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fterraform-aws-modules%2Fterraform-aws-secrets-manager","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fterraform-aws-modules%2Fterraform-aws-secrets-manager/lists"}