Class Secret
- All Implemented Interfaces:
IConstruct
,IDependable
,IResource
,ISecret
,software.amazon.jsii.JsiiSerializable
,software.constructs.IConstruct
- Direct Known Subclasses:
DatabaseSecret
,DatabaseSecret
,DatabaseSecret
Example:
// Creates a new IAM user, access and secret keys, and stores the secret access key in a Secret. User user = new User(this, "User"); AccessKey accessKey = AccessKey.Builder.create(this, "AccessKey").user(user).build(); SecretStringValueBeta1 secretValue = SecretStringValueBeta1.fromToken(accessKey.secretAccessKey.toString()); Secret.Builder.create(this, "Secret") .secretStringBeta1(secretValue) .build();
-
Nested Class Summary
Nested classes/interfaces inherited from class software.amazon.jsii.JsiiObject
software.amazon.jsii.JsiiObject.InitializationMode
Nested classes/interfaces inherited from interface software.amazon.awscdk.core.IConstruct
IConstruct.Jsii$Default
Nested classes/interfaces inherited from interface software.constructs.IConstruct
software.constructs.IConstruct.Jsii$Default
Nested classes/interfaces inherited from interface software.amazon.awscdk.core.IResource
IResource.Jsii$Default
Nested classes/interfaces inherited from interface software.amazon.awscdk.services.secretsmanager.ISecret
ISecret.Jsii$Default, ISecret.Jsii$Proxy
-
Constructor Summary
ModifierConstructorDescriptionprotected
Secret
(software.amazon.jsii.JsiiObject.InitializationMode initializationMode) protected
Secret
(software.amazon.jsii.JsiiObjectRef objRef) Secret
(software.constructs.Construct scope, String id, SecretProps props) -
Method Summary
Modifier and TypeMethodDescriptionvoid
addReplicaRegion
(String region) Adds a replica region for the secret.void
addReplicaRegion
(String region, IKey encryptionKey) Adds a replica region for the secret.addRotationSchedule
(String id, RotationScheduleOptions options) Adds a rotation schedule to the secret.addTargetAttachment
(String id, AttachedSecretOptions options) Deprecated.addToResourcePolicy
(PolicyStatement statement) Adds a statement to the IAM resource policy associated with this secret.attach
(ISecretAttachmentTarget target) Attach a target to this secret.void
Denies theDeleteSecret
action to all principals within the current account.static ISecret
fromSecretArn
(software.constructs.Construct scope, String id, String secretArn) Deprecated.usefromSecretCompleteArn
orfromSecretPartialArn
static ISecret
fromSecretAttributes
(software.constructs.Construct scope, String id, SecretAttributes attrs) Import an existing secret into the Stack.static ISecret
fromSecretCompleteArn
(software.constructs.Construct scope, String id, String secretCompleteArn) Imports a secret by complete ARN.static ISecret
fromSecretName
(software.constructs.Construct scope, String id, String secretName) Deprecated.usefromSecretNameV2
static ISecret
fromSecretNameV2
(software.constructs.Construct scope, String id, String secretName) Imports a secret by secret name.static ISecret
fromSecretPartialArn
(software.constructs.Construct scope, String id, String secretPartialArn) Imports a secret by partial ARN.protected String
Provides an identifier for this secret for use in IAM policies.protected Boolean
The customer-managed encryption key that is used to encrypt this secret, if any.The ARN of the secret in AWS Secrets Manager.The full ARN of the secret in AWS Secrets Manager, which is the ARN including the Secrets Manager-supplied 6-character suffix.The name of the secret.Retrieve the value of the stored secret as aSecretValue
.grantRead
(IGrantable grantee) Grants reading the secret value to some role.grantRead
(IGrantable grantee, List<String> versionStages) Grants reading the secret value to some role.grantWrite
(IGrantable grantee) Grants writing and updating the secret value to some role.secretValueFromJson
(String jsonField) Interpret the secret as a JSON object and return a field's value from it as aSecretValue
.validate()
Validate the current construct.Methods inherited from class software.amazon.awscdk.core.Resource
applyRemovalPolicy, generatePhysicalName, getEnv, getPhysicalName, getResourceArnAttribute, getResourceNameAttribute, getStack, isResource
Methods inherited from class software.amazon.awscdk.core.Construct
getNode, isConstruct, onPrepare, onSynthesize, onValidate, prepare, synthesize
Methods inherited from class software.constructs.Construct
toString
Methods inherited from class software.amazon.jsii.JsiiObject
jsiiAsyncCall, jsiiAsyncCall, jsiiCall, jsiiCall, jsiiGet, jsiiGet, jsiiSet, jsiiStaticCall, jsiiStaticCall, jsiiStaticGet, jsiiStaticGet, jsiiStaticSet, jsiiStaticSet
Methods inherited from class java.lang.Object
clone, equals, finalize, getClass, hashCode, notify, notifyAll, wait, wait, wait
Methods inherited from interface software.amazon.awscdk.core.IConstruct
getNode
Methods inherited from interface software.amazon.awscdk.core.IResource
applyRemovalPolicy, getEnv, getStack
Methods inherited from interface software.amazon.jsii.JsiiSerializable
$jsii$toJson
-
Constructor Details
-
Secret
protected Secret(software.amazon.jsii.JsiiObjectRef objRef) -
Secret
protected Secret(software.amazon.jsii.JsiiObject.InitializationMode initializationMode) -
Secret
@Stability(Stable) public Secret(@NotNull software.constructs.Construct scope, @NotNull String id, @Nullable SecretProps props) - Parameters:
scope
- This parameter is required.id
- This parameter is required.props
-
-
Secret
- Parameters:
scope
- This parameter is required.id
- This parameter is required.
-
-
Method Details
-
fromSecretArn
@Stability(Deprecated) @Deprecated @NotNull public static ISecret fromSecretArn(@NotNull software.constructs.Construct scope, @NotNull String id, @NotNull String secretArn) Deprecated.usefromSecretCompleteArn
orfromSecretPartialArn
- Parameters:
scope
- This parameter is required.id
- This parameter is required.secretArn
- This parameter is required.
-
fromSecretAttributes
@Stability(Stable) @NotNull public static ISecret fromSecretAttributes(@NotNull software.constructs.Construct scope, @NotNull String id, @NotNull SecretAttributes attrs) Import an existing secret into the Stack.- Parameters:
scope
- the scope of the import. This parameter is required.id
- the ID of the imported Secret in the construct tree. This parameter is required.attrs
- the attributes of the imported secret. This parameter is required.
-
fromSecretCompleteArn
@Stability(Stable) @NotNull public static ISecret fromSecretCompleteArn(@NotNull software.constructs.Construct scope, @NotNull String id, @NotNull String secretCompleteArn) Imports a secret by complete ARN.The complete ARN is the ARN with the Secrets Manager-supplied suffix.
- Parameters:
scope
- This parameter is required.id
- This parameter is required.secretCompleteArn
- This parameter is required.
-
fromSecretName
@Stability(Deprecated) @Deprecated @NotNull public static ISecret fromSecretName(@NotNull software.constructs.Construct scope, @NotNull String id, @NotNull String secretName) Deprecated.usefromSecretNameV2
(deprecated) Imports a secret by secret name;the ARN of the Secret will be set to the secret name. A secret with this name must exist in the same account & region.
- Parameters:
scope
- This parameter is required.id
- This parameter is required.secretName
- This parameter is required.
-
fromSecretNameV2
@Stability(Stable) @NotNull public static ISecret fromSecretNameV2(@NotNull software.constructs.Construct scope, @NotNull String id, @NotNull String secretName) Imports a secret by secret name.A secret with this name must exist in the same account & region. Replaces the deprecated
fromSecretName
.- Parameters:
scope
- This parameter is required.id
- This parameter is required.secretName
- This parameter is required.
-
fromSecretPartialArn
@Stability(Stable) @NotNull public static ISecret fromSecretPartialArn(@NotNull software.constructs.Construct scope, @NotNull String id, @NotNull String secretPartialArn) Imports a secret by partial ARN.The partial ARN is the ARN without the Secrets Manager-supplied suffix.
- Parameters:
scope
- This parameter is required.id
- This parameter is required.secretPartialArn
- This parameter is required.
-
addReplicaRegion
@Stability(Stable) public void addReplicaRegion(@NotNull String region, @Nullable IKey encryptionKey) Adds a replica region for the secret.- Parameters:
region
- The name of the region. This parameter is required.encryptionKey
- The customer-managed encryption key to use for encrypting the secret value.
-
addReplicaRegion
Adds a replica region for the secret.- Parameters:
region
- The name of the region. This parameter is required.
-
addRotationSchedule
@Stability(Stable) @NotNull public RotationSchedule addRotationSchedule(@NotNull String id, @NotNull RotationScheduleOptions options) Adds a rotation schedule to the secret.- Specified by:
addRotationSchedule
in interfaceISecret
- Parameters:
id
- This parameter is required.options
- This parameter is required.
-
addTargetAttachment
@Stability(Deprecated) @Deprecated @NotNull public SecretTargetAttachment addTargetAttachment(@NotNull String id, @NotNull AttachedSecretOptions options) Deprecated.useattach()
instead(deprecated) Adds a target attachment to the secret.- Parameters:
id
- This parameter is required.options
- This parameter is required.- Returns:
- an AttachedSecret
-
addToResourcePolicy
@Stability(Stable) @NotNull public AddToResourcePolicyResult addToResourcePolicy(@NotNull PolicyStatement statement) Adds a statement to the IAM resource policy associated with this secret.If this secret was created in this stack, a resource policy will be automatically created upon the first call to
addToResourcePolicy
. If the secret is imported, then this is a no-op.- Specified by:
addToResourcePolicy
in interfaceISecret
- Parameters:
statement
- This parameter is required.
-
attach
Attach a target to this secret. -
denyAccountRootDelete
@Stability(Stable) public void denyAccountRootDelete()Denies theDeleteSecret
action to all principals within the current account.- Specified by:
denyAccountRootDelete
in interfaceISecret
-
grantRead
@Stability(Stable) @NotNull public Grant grantRead(@NotNull IGrantable grantee, @Nullable List<String> versionStages) Grants reading the secret value to some role. -
grantRead
Grants reading the secret value to some role. -
grantWrite
Grants writing and updating the secret value to some role.- Specified by:
grantWrite
in interfaceISecret
- Parameters:
grantee
- This parameter is required.
-
secretValueFromJson
Interpret the secret as a JSON object and return a field's value from it as aSecretValue
.- Specified by:
secretValueFromJson
in interfaceISecret
- Parameters:
jsonField
- This parameter is required.
-
validate
Validate the current construct.This method can be implemented by derived constructs in order to perform validation logic. It is called on all constructs before synthesis.
-
getArnForPolicies
Provides an identifier for this secret for use in IAM policies.If there is a full ARN, this is just the ARN; if we have a partial ARN -- due to either importing by secret name or partial ARN -- then we need to add a suffix to capture the full ARN's format.
-
getAutoCreatePolicy
-
getSecretArn
The ARN of the secret in AWS Secrets Manager.Will return the full ARN if available, otherwise a partial arn. For secrets imported by the deprecated
fromSecretName
, it will return thesecretName
.- Specified by:
getSecretArn
in interfaceISecret
-
getSecretName
The name of the secret.For "owned" secrets, this will be the full resource name (secret name + suffix), unless the '@aws-cdk/aws-secretsmanager:parseOwnedSecretName' feature flag is set.
- Specified by:
getSecretName
in interfaceISecret
-
getSecretValue
Retrieve the value of the stored secret as aSecretValue
.- Specified by:
getSecretValue
in interfaceISecret
-
getEncryptionKey
The customer-managed encryption key that is used to encrypt this secret, if any.When not specified, the default KMS key for the account and region is being used.
- Specified by:
getEncryptionKey
in interfaceISecret
-
getSecretFullArn
The full ARN of the secret in AWS Secrets Manager, which is the ARN including the Secrets Manager-supplied 6-character suffix.This is equal to
secretArn
in most cases, but is undefined when a full ARN is not available (e.g., secrets imported by name).- Specified by:
getSecretFullArn
in interfaceISecret
-
attach()
instead