AWS Secrets Manager

Use AWS Secrets Manager to retrieve, create, update, list, describe, delete, restore, tag, untag, or rotate secrets. Configure AWS credentials with permission for the target region and secret.

Deletion and rotation affect credentials used by other systems. Review the selected operation's recovery window and rotation settings before running it. Secret values returned by these actions are available to later workflow steps; handle them as credentials.

Use the block

Retrieve, create, update, list, delete, describe, tag, untag, restore, and rotate secrets.

Actions

Secrets Manager Get Secret

Retrieve a secret value from AWS Secrets Manager

Inputs and outputs

Input

Parameter	Type	Required	Description
`region`	string	Yes	AWS region (e.g., us-east-1)
`accessKeyId`	string	Yes	AWS access key ID
`secretAccessKey`	string	Yes	AWS secret access key
`secretId`	string	Yes	The name or ARN of the secret to retrieve
`versionId`	string	No	The unique identifier of the version to retrieve
`versionStage`	string	No	The staging label of the version to retrieve (e.g., AWSCURRENT, AWSPREVIOUS)

Output

Parameter	Type	Description
`name`	string	Name of the secret
`secretValue`	string	The decrypted secret value
`arn`	string	ARN of the secret
`versionId`	string	Version ID of the secret
`versionStages`	array	Staging labels attached to this version
`createdDate`	string	Date the secret was created

Secrets Manager List Secrets

List secrets stored in AWS Secrets Manager

Inputs and outputs

Input

Parameter	Type	Required	Description
`region`	string	Yes	AWS region (e.g., us-east-1)
`accessKeyId`	string	Yes	AWS access key ID
`secretAccessKey`	string	Yes	AWS secret access key
`maxResults`	number	No	Maximum number of secrets to return (1-100, default 100)
`nextToken`	string	No	Pagination token from a previous request

Output

Parameter	Type	Description
`secrets`	json	List of secrets with name, ARN, description, dates, rotation rules/window, and version-to-stage mappings
`nextToken`	string	Pagination token for the next page of results
`count`	number	Number of secrets returned

Secrets Manager Create Secret

Create a new secret in AWS Secrets Manager

Inputs and outputs

Input

Parameter	Type	Required	Description
`region`	string	Yes	AWS region (e.g., us-east-1)
`accessKeyId`	string	Yes	AWS access key ID
`secretAccessKey`	string	Yes	AWS secret access key
`name`	string	Yes	Name of the secret to create
`secretValue`	string	Yes	The secret value (plain text or JSON string)
`description`	string	No	Description of the secret

Output

Parameter	Type	Description
`message`	string	Operation status message
`name`	string	Name of the created secret
`arn`	string	ARN of the created secret
`versionId`	string	Version ID of the created secret

Secrets Manager Update Secret

Update the value of an existing secret in AWS Secrets Manager

Inputs and outputs

Input

Parameter	Type	Required	Description
`region`	string	Yes	AWS region (e.g., us-east-1)
`accessKeyId`	string	Yes	AWS access key ID
`secretAccessKey`	string	Yes	AWS secret access key
`secretId`	string	Yes	The name or ARN of the secret to update
`secretValue`	string	Yes	The new secret value (plain text or JSON string)
`description`	string	No	Updated description of the secret

Output

Parameter	Type	Description
`message`	string	Operation status message
`name`	string	Name of the updated secret
`arn`	string	ARN of the updated secret
`versionId`	string	Version ID of the updated secret

Secrets Manager Delete Secret

Delete a secret from AWS Secrets Manager

Inputs and outputs

Input

Parameter	Type	Required	Description
`region`	string	Yes	AWS region (e.g., us-east-1)
`accessKeyId`	string	Yes	AWS access key ID
`secretAccessKey`	string	Yes	AWS secret access key
`secretId`	string	Yes	The name or ARN of the secret to delete
`recoveryWindowInDays`	number	No	Number of days before permanent deletion (7-30, default 30)
`forceDelete`	boolean	No	If true, immediately delete without recovery window

Output

Parameter	Type	Description
`message`	string	Operation status message
`name`	string	Name of the deleted secret
`arn`	string	ARN of the deleted secret
`deletionDate`	string	Scheduled deletion date

Secrets Manager Describe Secret

Retrieve full metadata for a secret in AWS Secrets Manager, including rotation configuration and replication status, without exposing the secret value

Inputs and outputs

Input

Parameter	Type	Required	Description
`region`	string	Yes	AWS region (e.g., us-east-1)
`accessKeyId`	string	Yes	AWS access key ID
`secretAccessKey`	string	Yes	AWS secret access key
`secretId`	string	Yes	The name or ARN of the secret to describe

Output

Parameter	Type	Description
`name`	string	Name of the secret
`arn`	string	ARN of the secret
`description`	string	Description of the secret
`kmsKeyId`	string	KMS key ID used to encrypt the secret
`rotationEnabled`	boolean	Whether automatic rotation is enabled
`rotationLambdaARN`	string	ARN of the Lambda function used for rotation
`rotationRules`	json	Rotation schedule configuration
`lastRotatedDate`	string	Date the secret was last rotated
`lastChangedDate`	string	Date the secret was last changed
`lastAccessedDate`	string	Date the secret was last accessed
`deletedDate`	string	Scheduled deletion date
`nextRotationDate`	string	Date the secret is next scheduled to rotate
`tags`	array	Tags attached to the secret
`versionIdsToStages`	json	Map of version IDs to their staging labels
`owningService`	string	ID of the AWS service that manages this secret, if any
`createdDate`	string	Date the secret was created
`primaryRegion`	string	The primary region of the secret, if replicated
`replicationStatus`	array	Replication status for each region the secret is replicated to

Secrets Manager Tag Resource

Attach tags to a secret in AWS Secrets Manager

Inputs and outputs

Input

Parameter	Type	Required	Description
`region`	string	Yes	AWS region (e.g., us-east-1)
`accessKeyId`	string	Yes	AWS access key ID
`secretAccessKey`	string	Yes	AWS secret access key
`secretId`	string	Yes	The name or ARN of the secret to tag
`tags`	json	Yes	Tags to attach, as an array of {key, value} pairs (max 50)

Output

Parameter	Type	Description
`message`	string	Operation status message
`name`	string	Name or ARN of the tagged secret

Secrets Manager Untag Resource

Remove tags from a secret in AWS Secrets Manager

Inputs and outputs

Input

Parameter	Type	Required	Description
`region`	string	Yes	AWS region (e.g., us-east-1)
`accessKeyId`	string	Yes	AWS access key ID
`secretAccessKey`	string	Yes	AWS secret access key
`secretId`	string	Yes	The name or ARN of the secret to untag
`tagKeys`	json	Yes	Tag keys to remove, as an array of strings (max 50)

Output

Parameter	Type	Description
`message`	string	Operation status message
`name`	string	Name or ARN of the untagged secret

Secrets Manager Restore Secret

Cancel a scheduled deletion for a secret in AWS Secrets Manager, restoring access to it

Inputs and outputs

Input

Parameter	Type	Required	Description
`region`	string	Yes	AWS region (e.g., us-east-1)
`accessKeyId`	string	Yes	AWS access key ID
`secretAccessKey`	string	Yes	AWS secret access key
`secretId`	string	Yes	The name or ARN of the secret to restore

Output

Parameter	Type	Description
`message`	string	Operation status message
`name`	string	Name of the restored secret
`arn`	string	ARN of the restored secret

Secrets Manager Rotate Secret

Start or reconfigure rotation for a secret in AWS Secrets Manager

Inputs and outputs

Input

Parameter	Type	Required	Description
`region`	string	Yes	AWS region (e.g., us-east-1)
`accessKeyId`	string	Yes	AWS access key ID
`secretAccessKey`	string	Yes	AWS secret access key
`secretId`	string	Yes	The name or ARN of the secret to rotate
`clientRequestToken`	string	No	Idempotency token for the new secret version (32-64 characters)
`rotationLambdaARN`	string	No	ARN of the Lambda function that performs rotation (omit for managed rotation)
`automaticallyAfterDays`	number	No	Number of days between rotations (1-1000). Mutually exclusive with schedule expression
`duration`	string	No	Length of the rotation window in hours, e.g. "3h"
`scheduleExpression`	string	No	A cron() or rate() expression defining the rotation schedule
`rotateImmediately`	boolean	No	Whether to rotate immediately (default true) or wait for the next scheduled window

Output

Parameter	Type	Description
`message`	string	Operation status message
`name`	string	Name of the secret
`arn`	string	ARN of the secret
`versionId`	string	ID of the new secret version created by rotation