SecretStringValueBeta1 Class
An experimental class used to specify an initial secret value for a Secret.
The class wraps a simple string (or JSON representation) in order to provide some safety checks and warnings about the dangers of using plaintext strings as initial secret seed values via CDK/CloudFormation.
Example
const user = new iam.User(this, 'User');
const accessKey = new iam.AccessKey(this, 'AccessKey', { user });
const secretValue = secretsmanager.SecretStringValueBeta1.fromToken(JSON.stringify({
username: user.userName,
database: 'foo',
password: accessKey.secretAccessKey.unsafeUnwrap(),
}));
Methods
fromToken(secretValueFromToken: string): SecretStringValueBeta1 // chainable@staticmethod def from_token(secret_value_from_token: str) -> SecretStringValueBeta1public static SecretStringValueBeta1 fromToken(String secretValueFromToken)public static SecretStringValueBeta1 FromToken(string secretValueFromToken)func FromToken(SecretValueFromToken *string) SecretStringValueBeta1static#notes · 1 parameter
The intent is to enable creating secrets from references (e.g., Ref, Fn::GetAtt) from other resources. This might be the direct output of another Construct, or the output of a Custom Resource. This method throws if it determines the input is an unsafe plaintext string.
For example:
// Creates a new IAM user, access and secret keys, and stores the secret access key in a Secret.
const user = new iam.User(this, 'User');
const accessKey = new iam.AccessKey(this, 'AccessKey', { user });
const secret = new secretsmanager.Secret(this, 'Secret', {
secretStringValue: accessKey.secretAccessKey,
});
The secret may also be embedded in a string representation of a JSON structure:
const user = new iam.User(this, 'User');
const accessKey = new iam.AccessKey(this, 'AccessKey', { user });
const secretValue = secretsmanager.SecretStringValueBeta1.fromToken(JSON.stringify({
username: user.userName,
database: 'foo',
password: accessKey.secretAccessKey.unsafeUnwrap(),
}));
Note that the value being a Token does not guarantee safety. For example, a Lazy-evaluated string (e.g., Lazy.string({ produce: () => 'myInsecurePassword' }))) is a Token, but as the output is ultimately a plaintext string, and so insecure.
Parameters
secretValueFromTokensecret_value_from_tokensecretValueFromTokensecretValueFromTokenSecretValueFromToken— a secret value coming from a Construct attribute or Custom Resource output.
fromUnsafePlaintext(secretValue: string): SecretStringValueBeta1 // chainable@staticmethod def from_unsafe_plaintext(secret_value: str) -> SecretStringValueBeta1public static SecretStringValueBeta1 fromUnsafePlaintext(String secretValue)public static SecretStringValueBeta1 FromUnsafePlaintext(string secretValue)func FromUnsafePlaintext(SecretValue *string) SecretStringValueBeta1static#notes
This approach is inherently unsafe, as the secret value may be visible in your source control repository and will also appear in plaintext in the resulting CloudFormation template, including in the AWS Console or APIs. Usage of this method is discouraged, especially for production workloads.
secretValue(): stringdef secret_value(self, ) -> strpublic String secretValue()public string SecretValue()func SecretValue() *string#