# ISecretTargetAttachment

Extends: ISecretTargetAttachment
Extends: ISecret, ISecretTargetAttachmentRef
Implemented by: SecretTargetAttachment

- Source: [`aws-secretsmanager/lib/secret.ts`](https://github.com/aws/aws-cdk/blob/v2.275.0/packages/aws-cdk-lib/aws-secretsmanager/lib/secret.ts#L881)
- Type last changed: v2.234.0 · 8 Jan 2026

## Properties

- `encryptionKey`: [IKey](/cdk/api/v2/docs/aws-cdk-lib.aws_kms.IKey.html) — The customer-managed encryption key that is used to encrypt this secret, if any.

  When not specified, the default
  KMS key for the account and region is being used.

- `env`: [ResourceEnvironment](/cdk/api/v2/docs/aws-cdk-lib.interfaces.ResourceEnvironment.html) — The environment this resource belongs to.

  For resources that are created and managed in a Stack (those created by
  creating new class instances like `new Role()`, `new Bucket()`, etc.), this
  is always the same as the environment of the stack they belong to.

  For referenced resources (those obtained from referencing methods like
  `Role.fromRoleArn()`, `Bucket.fromBucketName()`, etc.), they might be
  different than the stack they were imported into.

- `node`: [Node](/cdk/api/v2/docs/constructs.Node.html) — The tree node.

- `secretArn`: string — The ARN of the secret in AWS Secrets Manager.

  Will return the full ARN if available, otherwise a partial arn.
  For secrets imported by the deprecated `fromSecretName`, it will return the `secretName`.

- `secretFullArn`: string — The full ARN of the secret in AWS Secrets Manager, which is the ARN including the Secrets Manager-supplied 6-character suffix.

  This is equal to `secretArn` in most cases, but is undefined when a full ARN is not available (e.g., secrets imported by name).

- `secretName`: string — The name of the secret.

  For "owned" secrets, this will be the full resource name (secret name + suffix), unless the
  '@aws-cdk/aws-secretsmanager:parseOwnedSecretName' feature flag is set.

- `secretRef`: [SecretReference](/cdk/api/v2/docs/aws-cdk-lib.interfaces.aws_secretsmanager.SecretReference.html) — A reference to a Secret resource.

- `secretTargetAttachmentRef`: [SecretTargetAttachmentReference](/cdk/api/v2/docs/aws-cdk-lib.interfaces.aws_secretsmanager.SecretTargetAttachmentReference.html) — A reference to a SecretTargetAttachment resource.

- `secretTargetAttachmentSecretArn`: string — Same as `secretArn`.

- `secretValue`: [SecretValue](/cdk/api/v2/docs/aws-cdk-lib.SecretValue.html) — Retrieve the value of the stored secret as a `SecretValue`.

- `stack`: [Stack](/cdk/api/v2/docs/aws-cdk-lib.Stack.html) — The stack in which this resource is defined.

## Methods

- `addRotationSchedule(id: string, options: RotationScheduleOptions): RotationSchedule` — Adds a rotation schedule to the secret.

- `addToResourcePolicy(statement: PolicyStatement): AddToResourcePolicyResult` — Adds a statement to the IAM resource policy associated with this secret.

  If this secret was created in this stack, a resource policy will be
  automatically created upon the first call to `addToResourcePolicy`. If
  the secret is imported, then this is a no-op.

- `applyRemovalPolicy(policy: RemovalPolicy): void` — Apply the given removal policy to this resource.

  The Removal Policy controls what happens to this resource when it stops
  being managed by CloudFormation, either because you've removed it from the
  CDK application or because you've made a change that requires the resource
  to be replaced.

  The resource can be deleted (`RemovalPolicy.DESTROY`), or left in your AWS
  account for data recovery and cleanup later (`RemovalPolicy.RETAIN`).

- `attach(target: ISecretAttachmentTarget): ISecret` — Attach a target to this secret.

  **Parameters**

  - `target` — The target to attach.

  **Returns:** An attached secret

- `cfnDynamicReferenceKey(options?: SecretsManagerSecretOptions): string` — Returns a key which can be used within an AWS CloudFormation dynamic reference to dynamically load this secret from AWS Secrets Manager.

  **Parameters**

  - `options` — Options.

- `denyAccountRootDelete(): void` — Denies the `DeleteSecret` action to all principals within the current account.

- `grantRead(grantee: IGrantable, versionStages?: string[]): Grant` — Grants reading the secret value to some role.

  **Parameters**

  - `grantee` — the principal being granted permission.
  - `versionStages` — the version stages the grant is limited to.

- `grantWrite(grantee: IGrantable): Grant` — Grants writing and updating the secret value to some role.

  **Parameters**

  - `grantee` — the principal being granted permission.

- `secretValueFromJson(key: string): SecretValue` — Interpret the secret as a JSON object and return a field's value from it as a `SecretValue`.

- `with(...mixins: IMixin[]): IConstruct` — Applies one or more mixins to this construct.

  Mixins are applied in order. The list of constructs is captured at the
  start of the call, so constructs added by a mixin will not be visited.

  **Parameters**

  - `mixins` — The mixins to apply.

  **Returns:** This construct for chaining