Get a detailed overview of this resourceList the top 5 use cases for this resourceBuild a program using aws.secretsmanager.SecretRepositoryAWS Classic pulumi/pulumi-awsLicenseApache-2.0NotesThis Pulumi package is based on the aws Terraform Provider.
AWS v7.32.0, May 29 26
AWS v7.32.0, May 29 26
Viewing docs for AWS v7.32.0
published on Friday, May 29, 2026 by Pulumi
v7.32.0 (7.x, latest)v6.83.1 (6.x)v5.43.0 (5.x)
aws.secretsmanager.Secret Anchor
Explore with Neo
Explain this resource Show real-world scenarios Provision a new instance
Viewing docs for AWS v7.32.0
published on Friday, May 29, 2026 by Pulumi
v7.32.0 (7.x, latest)v6.83.1 (6.x)v5.43.0 (5.x)
On this page
On this page
- Example Usage
- Basic
- Create Secret Resource
- Constructor syntax
- Constructor example
- Secret Resource Properties
- Inputs
- Outputs
- Look up Existing Secret Resource
- Supporting Types
- Import
- Identity Schema
- Package Details
Related Resources
Copy Page
[Scroll to top](/content/registry/packages/aws/api-docs/secretsmanager/secret/# "Scroll to top"/index.html)
Provides a resource to manage AWS Secrets Manager secret metadata. To manage secret rotation, see the aws.secretsmanager.SecretRotation resource. To manage a secret value, see the aws.secretsmanager.SecretVersion resource.
Example Usage Anchor
Basic Anchor
- TypeScript
- Python
- Go
- C#
- Java
- YAML
- HCL PREVIEW
import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";
const example = new aws.secretsmanager.Secret("example", {name: "example"});
Copy
import pulumi
import pulumi_aws as aws
example = aws.secretsmanager.Secret("example", name="example")
Copy
package main
import (
"github.com/pulumi/pulumi-aws/sdk/v7/go/aws/secretsmanager"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
_, err := secretsmanager.NewSecret(ctx, "example", &secretsmanager.SecretArgs{
Name: pulumi.String("example"),
})
if err != nil {
return err
}
return nil
})
}
Copy
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Aws = Pulumi.Aws;
return await Deployment.RunAsync(() =>
{
var example = new Aws.SecretsManager.Secret("example", new()
{
Name = "example",
});
});
Copy
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.aws.secretsmanager.Secret;
import com.pulumi.aws.secretsmanager.SecretArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
var example = new Secret("example", SecretArgs.builder()
.name("example")
.build());
}
}
Copy
resources:
example:
type: aws:secretsmanager:Secret
properties:
name: example
Copy
pulumi {
required_providers {
aws = {
source = "pulumi/aws"
}
}
}
resource "aws_secretsmanager_secret" "example" {
name = "example"
}
Copy
Create Secret Resource Anchor
Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.
Constructor syntax Anchor
- TypeScript
- Python
- Go
- C#
- Java
- YAML
- HCL PREVIEW
new Secret(name: string, args?: SecretArgs, opts?: CustomResourceOptions);
@overload
def Secret(resource_name: str,
args: Optional[SecretArgs] = None,
opts: Optional[ResourceOptions] = None)
@overload
def Secret(resource_name: str,
opts: Optional[ResourceOptions] = None,
description: Optional[str] = None,
force_overwrite_replica_secret: Optional[bool] = None,
kms_key_id: Optional[str] = None,
name: Optional[str] = None,
name_prefix: Optional[str] = None,
policy: Optional[str] = None,
recovery_window_in_days: Optional[int] = None,
region: Optional[str] = None,
replicas: Optional[Sequence[SecretReplicaArgs]] = None,
tags: Optional[Mapping[str, str]] = None)
func NewSecret(ctx *Context, name string, args *SecretArgs, opts ...ResourceOption) (*Secret, error)
public Secret(string name, SecretArgs? args = null, CustomResourceOptions? opts = null)
public Secret(String name, SecretArgs args)
public Secret(String name, SecretArgs args, CustomResourceOptions options)
type: aws:secretsmanager:Secret
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.
resource "aws_secretsmanager_secret" "name" {
# resource properties
}
Parameters Anchor
nameThis property is required.stringThe unique name of the resource.argsSecretArgsThe arguments to resource properties.optsCustomResourceOptionsBag of options to control resource's behavior.
resource_nameThis property is required.strThe unique name of the resource.argsSecretArgsThe arguments to resource properties.optsResourceOptionsBag of options to control resource's behavior.
ctxContextContext object for the current deployment.nameThis property is required.stringThe unique name of the resource.argsSecretArgsThe arguments to resource properties.optsResourceOptionBag of options to control resource's behavior.
nameThis property is required.stringThe unique name of the resource.argsSecretArgsThe arguments to resource properties.optsCustomResourceOptionsBag of options to control resource's behavior.
nameThis property is required.StringThe unique name of the resource.argsThis property is required.SecretArgsThe arguments to resource properties.optionsCustomResourceOptionsBag of options to control resource's behavior.
Constructor example Anchor
The following reference example uses placeholder values for all input properties.
- TypeScript
- Python
- Go
- C#
- Java
- YAML
- HCL PREVIEW
var secretResource = new Aws.SecretsManager.Secret("secretResource", new()
{
Description = "string",
ForceOverwriteReplicaSecret = false,
KmsKeyId = "string",
Name = "string",
NamePrefix = "string",
Policy = "string",
RecoveryWindowInDays = 0,
Region = "string",
Replicas = new[]
{
new Aws.SecretsManager.Inputs.SecretReplicaArgs
{
Region = "string",
KmsKeyId = "string",
LastAccessedDate = "string",
Status = "string",
StatusMessage = "string",
},
},
Tags =
{
{ "string", "string" },
},
});
Copy
example, err := secretsmanager.NewSecret(ctx, "secretResource", &secretsmanager.SecretArgs{
Description: pulumi.String("string"),
ForceOverwriteReplicaSecret: pulumi.Bool(false),
KmsKeyId: pulumi.String("string"),
Name: pulumi.String("string"),
NamePrefix: pulumi.String("string"),
Policy: pulumi.String("string"),
RecoveryWindowInDays: pulumi.Int(0),
Region: pulumi.String("string"),
Replicas: secretsmanager.SecretReplicaArray{
&secretsmanager.SecretReplicaArgs{
Region: pulumi.String("string"),
KmsKeyId: pulumi.String("string"),
LastAccessedDate: pulumi.String("string"),
Status: pulumi.String("string"),
StatusMessage: pulumi.String("string"),
},
},
Tags: pulumi.StringMap{
"string": pulumi.String("string"),
},
})
Copy
resource "aws_secretsmanager_secret" "secretResource" {
description = "string"
force_overwrite_replica_secret = false
kms_key_id = "string"
name = "string"
name_prefix = "string"
policy = "string"
recovery_window_in_days = 0
region = "string"
replicas {
region = "string"
kms_key_id = "string"
last_accessed_date = "string"
status = "string"
status_message = "string"
}
tags = {
"string" = "string"
}
}
Copy
var secretResource = new Secret("secretResource", SecretArgs.builder()
.description("string")
.forceOverwriteReplicaSecret(false)
.kmsKeyId("string")
.name("string")
.namePrefix("string")
.policy("string")
.recoveryWindowInDays(0)
.region("string")
.replicas(SecretReplicaArgs.builder()
.region("string")
.kmsKeyId("string")
.lastAccessedDate("string")
.status("string")
.statusMessage("string")
.build())
.tags(Map.of("string", "string"))
.build());
Copy
secret_resource = aws.secretsmanager.Secret("secretResource",
description="string",
force_overwrite_replica_secret=False,
kms_key_id="string",
name="string",
name_prefix="string",
policy="string",
recovery_window_in_days=0,
region="string",
replicas=[{\
"region": "string",\
"kms_key_id": "string",\
"last_accessed_date": "string",\
"status": "string",\
"status_message": "string",\
}],
tags={
"string": "string",
})
Copy
const secretResource = new aws.secretsmanager.Secret("secretResource", {
description: "string",
forceOverwriteReplicaSecret: false,
kmsKeyId: "string",
name: "string",
namePrefix: "string",
policy: "string",
recoveryWindowInDays: 0,
region: "string",
replicas: [{\
region: "string",\
kmsKeyId: "string",\
lastAccessedDate: "string",\
status: "string",\
statusMessage: "string",\
}],
tags: {
string: "string",
},
});
Copy
type: aws:secretsmanager:Secret
properties:
description: string
forceOverwriteReplicaSecret: false
kmsKeyId: string
name: string
namePrefix: string
policy: string
recoveryWindowInDays: 0
region: string
replicas:
- kmsKeyId: string
lastAccessedDate: string
region: string
status: string
statusMessage: string
tags:
string: string
Copy
Secret Resource Properties Anchor
To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.
Inputs Anchor
In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.
The Secret resource accepts the following input properties:
DescriptionstringDescription of the secret.ForceOverwriteReplicaSecretboolAccepts boolean value to specify whether to overwrite a secret with the same name in the destination Region.KmsKeyIdstringARN or Id of the AWS KMS key to be used to encrypt the secret values in the versions stored in this secret. If you need to reference a CMK in a different account, you can use only the key ARN. If you don't specify this value, then Secrets Manager defaults to using the AWS account's default KMS key (the one named aws/secretsmanager). If the default KMS key with that name doesn't yet exist, then AWS Secrets Manager creates it for you automatically the first time.NameChanges to this property will trigger replacement.stringFriendly name of the new secret. The secret name can consist of uppercase letters, lowercase letters, digits, and any of the following characters: /_+=.@- Conflicts with namePrefix.NamePrefixChanges to this property will trigger replacement.stringCreates a unique name beginning with the specified prefix. Conflicts with name.PolicystringValid JSON document representing a resource policy. Removing policy from your configuration or setting policy to null or an empty string (i.e., policy = "") will not delete the policy since it could have been set by aws.secretsmanager.SecretPolicy. To delete the policy, set it to "{}" (an empty JSON document).RecoveryWindowInDaysintNumber of days that AWS Secrets Manager waits before it can delete the secret. This value can be 0 to force deletion without recovery or range from 7 to 30 days. The default value is 30.RegionstringRegion where this resource will be managed. Defaults to the Region set in the provider configuration.ReplicasListdefaultTags configuration block present, tags with matching keys will overwrite those defined at the provider-level.
DescriptionstringDescription of the secret.ForceOverwriteReplicaSecretboolAccepts boolean value to specify whether to overwrite a secret with the same name in the destination Region.KmsKeyIdstringARN or Id of the AWS KMS key to be used to encrypt the secret values in the versions stored in this secret. If you need to reference a CMK in a different account, you can use only the key ARN. If you don't specify this value, then Secrets Manager defaults to using the AWS account's default KMS key (the one named aws/secretsmanager). If the default KMS key with that name doesn't yet exist, then AWS Secrets Manager creates it for you automatically the first time.NameChanges to this property will trigger replacement.stringFriendly name of the new secret. The secret name can consist of uppercase letters, lowercase letters, digits, and any of the following characters: /_+=.@- Conflicts with namePrefix.NamePrefixChanges to this property will trigger replacement.stringCreates a unique name beginning with the specified prefix. Conflicts with name.PolicystringValid JSON document representing a resource policy. Removing policy from your configuration or setting policy to null or an empty string (i.e., policy = "") will not delete the policy since it could have been set by aws.secretsmanager.SecretPolicy. To delete the policy, set it to "{}" (an empty JSON document).RecoveryWindowInDaysintNumber of days that AWS Secrets Manager waits before it can delete the secret. This value can be 0 to force deletion without recovery or range from 7 to 30 days. The default value is 30.RegionstringRegion where this resource will be managed. Defaults to the Region set in the provider configuration.Replicas[]SecretReplicaArgsConfiguration block to support secret replication. See details below.Tagsmap[string]stringKey-value map of user-defined tags that are attached to the secret. If configured with a provider defaultTags configuration block present, tags with matching keys will overwrite those defined at the provider-level.
descriptionstringDescription of the secret.force_overwrite_replica_secretboolAccepts boolean value to specify whether to overwrite a secret with the same name in the destination Region.kms_key_idstringARN or Id of the AWS KMS key to be used to encrypt the secret values in the versions stored in this secret. If you need to reference a CMK in a different account, you can use only the key ARN. If you don't specify this value, then Secrets Manager defaults to using the AWS account's default KMS key (the one named aws/secretsmanager). If the default KMS key with that name doesn't yet exist, then AWS Secrets Manager creates it for you automatically the first time.nameChanges to this property will trigger replacement.stringFriendly name of the new secret. The secret name can consist of uppercase letters, lowercase letters, digits, and any of the following characters: /_+=.@- Conflicts with namePrefix.name_prefixChanges to this property will trigger replacement.stringCreates a unique name beginning with the specified prefix. Conflicts with name.policystringValid JSON document representing a resource policy. Removing policy from your configuration or setting policy to null or an empty string (i.e., policy = "") will not delete the policy since it could have been set by aws.secretsmanager.SecretPolicy. To delete the policy, set it to "{}" (an empty JSON document).recovery_window_in_daysnumberNumber of days that AWS Secrets Manager waits before it can delete the secret. This value can be 0 to force deletion without recovery or range from 7 to 30 days. The default value is 30.regionstringRegion where this resource will be managed. Defaults to the Region set in the provider configuration.replicaslist(object)Configuration block to support secret replication. See details below.tagsmap(string)Key-value map of user-defined tags that are attached to the secret. If configured with a provider defaultTags configuration block present, tags with matching keys will overwrite those defined at the provider-level.
descriptionStringDescription of the secret.forceOverwriteReplicaSecretBooleanAccepts boolean value to specify whether to overwrite a secret with the same name in the destination Region.kmsKeyIdStringARN or Id of the AWS KMS key to be used to encrypt the secret values in the versions stored in this secret. If you need to reference a CMK in a different account, you can use only the key ARN. If you don't specify this value, then Secrets Manager defaults to using the AWS account's default KMS key (the one named aws/secretsmanager). If the default KMS key with that name doesn't yet exist, then AWS Secrets Manager creates it for you automatically the first time.nameChanges to this property will trigger replacement.StringFriendly name of the new secret. The secret name can consist of uppercase letters, lowercase letters, digits, and any of the following characters: /_+=.@- Conflicts with namePrefix.namePrefixChanges to this property will trigger replacement.StringCreates a unique name beginning with the specified prefix. Conflicts with name.policyStringValid JSON document representing a resource policy. Removing policy from your configuration or setting policy to null or an empty string (i.e., policy = "") will not delete the policy since it could have been set by aws.secretsmanager.SecretPolicy. To delete the policy, set it to "{}" (an empty JSON document).recoveryWindowInDaysIntegerNumber of days that AWS Secrets Manager waits before it can delete the secret. This value can be 0 to force deletion without recovery or range from 7 to 30 days. The default value is 30.regionStringRegion where this resource will be managed. Defaults to the Region set in the provider configuration.replicasListdefaultTags configuration block present, tags with matching keys will overwrite those defined at the provider-level.
descriptionstringDescription of the secret.forceOverwriteReplicaSecretbooleanAccepts boolean value to specify whether to overwrite a secret with the same name in the destination Region.kmsKeyIdstringARN or Id of the AWS KMS key to be used to encrypt the secret values in the versions stored in this secret. If you need to reference a CMK in a different account, you can use only the key ARN. If you don't specify this value, then Secrets Manager defaults to using the AWS account's default KMS key (the one named aws/secretsmanager). If the default KMS key with that name doesn't yet exist, then AWS Secrets Manager creates it for you automatically the first time.nameChanges to this property will trigger replacement.stringFriendly name of the new secret. The secret name can consist of uppercase letters, lowercase letters, digits, and any of the following characters: /_+=.@- Conflicts with namePrefix.namePrefixChanges to this property will trigger replacement.stringCreates a unique name beginning with the specified prefix. Conflicts with name.policystringValid JSON document representing a resource policy. Removing policy from your configuration or setting policy to null or an empty string (i.e., policy = "") will not delete the policy since it could have been set by aws.secretsmanager.SecretPolicy. To delete the policy, set it to "{}" (an empty JSON document).recoveryWindowInDaysnumberNumber of days that AWS Secrets Manager waits before it can delete the secret. This value can be 0 to force deletion without recovery or range from 7 to 30 days. The default value is 30.regionstringRegion where this resource will be managed. Defaults to the Region set in the provider configuration.replicasSecretReplica[]Configuration block to support secret replication. See details below.tags{[key: string]: string}Key-value map of user-defined tags that are attached to the secret. If configured with a provider defaultTags configuration block present, tags with matching keys will overwrite those defined at the provider-level.
descriptionstrDescription of the secret.force_overwrite_replica_secretboolAccepts boolean value to specify whether to overwrite a secret with the same name in the destination Region.kms_key_idstrARN or Id of the AWS KMS key to be used to encrypt the secret values in the versions stored in this secret. If you need to reference a CMK in a different account, you can use only the key ARN. If you don't specify this value, then Secrets Manager defaults to using the AWS account's default KMS key (the one named aws/secretsmanager). If the default KMS key with that name doesn't yet exist, then AWS Secrets Manager creates it for you automatically the first time.nameChanges to this property will trigger replacement.strFriendly name of the new secret. The secret name can consist of uppercase letters, lowercase letters, digits, and any of the following characters: /_+=.@- Conflicts with namePrefix.name_prefixChanges to this property will trigger replacement.strCreates a unique name beginning with the specified prefix. Conflicts with name.policystrValid JSON document representing a resource policy. Removing policy from your configuration or setting policy to null or an empty string (i.e., policy = "") will not delete the policy since it could have been set by aws.secretsmanager.SecretPolicy. To delete the policy, set it to "{}" (an empty JSON document).recovery_window_in_daysintNumber of days that AWS Secrets Manager waits before it can delete the secret. This value can be 0 to force deletion without recovery or range from 7 to 30 days. The default value is 30.regionstrRegion where this resource will be managed. Defaults to the Region set in the provider configuration.replicasSequence[SecretReplicaArgs]Configuration block to support secret replication. See details below.tagsMapping[str, str]Key-value map of user-defined tags that are attached to the secret. If configured with a provider defaultTags configuration block present, tags with matching keys will overwrite those defined at the provider-level.
descriptionStringDescription of the secret.forceOverwriteReplicaSecretBooleanAccepts boolean value to specify whether to overwrite a secret with the same name in the destination Region.kmsKeyIdStringARN or Id of the AWS KMS key to be used to encrypt the secret values in the versions stored in this secret. If you need to reference a CMK in a different account, you can use only the key ARN. If you don't specify this value, then Secrets Manager defaults to using the AWS account's default KMS key (the one named aws/secretsmanager). If the default KMS key with that name doesn't yet exist, then AWS Secrets Manager creates it for you automatically the first time.nameChanges to this property will trigger replacement.StringFriendly name of the new secret. The secret name can consist of uppercase letters, lowercase letters, digits, and any of the following characters: /_+=.@- Conflicts with namePrefix.namePrefixChanges to this property will trigger replacement.StringCreates a unique name beginning with the specified prefix. Conflicts with name.policyStringValid JSON document representing a resource policy. Removing policy from your configuration or setting policy to null or an empty string (i.e., policy = "") will not delete the policy since it could have been set by aws.secretsmanager.SecretPolicy. To delete the policy, set it to "{}" (an empty JSON document).recoveryWindowInDaysNumberNumber of days that AWS Secrets Manager waits before it can delete the secret. This value can be 0 to force deletion without recovery or range from 7 to 30 days. The default value is 30.regionStringRegion where this resource will be managed. Defaults to the Region set in the provider configuration.replicasListdefaultTags configuration block present, tags with matching keys will overwrite those defined at the provider-level.
Outputs Anchor
All input properties are implicitly available as output properties. Additionally, the Secret resource produces the following output properties:
ArnstringARN of the secret.IdstringThe provider-assigned unique ID for this managed resource.TagsAllDictionary<string, string>Map of tags assigned to the resource, including those inherited from the provider defaultTags configuration block.
ArnstringARN of the secret.IdstringThe provider-assigned unique ID for this managed resource.TagsAllmap[string]stringMap of tags assigned to the resource, including those inherited from the provider defaultTags configuration block.
arnstringARN of the secret.idstringThe provider-assigned unique ID for this managed resource.tags_allmap(string)Map of tags assigned to the resource, including those inherited from the provider defaultTags configuration block.
arnStringARN of the secret.idStringThe provider-assigned unique ID for this managed resource.tagsAllMap<String,String>Map of tags assigned to the resource, including those inherited from the provider defaultTags configuration block.
arnstringARN of the secret.idstringThe provider-assigned unique ID for this managed resource.tagsAll{[key: string]: string}Map of tags assigned to the resource, including those inherited from the provider defaultTags configuration block.
arnstrARN of the secret.idstrThe provider-assigned unique ID for this managed resource.tags_allMapping[str, str]Map of tags assigned to the resource, including those inherited from the provider defaultTags configuration block.
arnStringARN of the secret.idStringThe provider-assigned unique ID for this managed resource.tagsAllMapdefaultTags configuration block.
Look up Existing Secret Resource Anchor
Get an existing Secret resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.
- TypeScript
- Python
- Go
- C#
- Java
- YAML
- HCL PREVIEW
public static get(name: string, id: Input<ID>, state?: SecretState, opts?: CustomResourceOptions): Secret
@staticmethod
def get(resource_name: str,
id: str,
opts: Optional[ResourceOptions] = None,
arn: Optional[str] = None,
description: Optional[str] = None,
force_overwrite_replica_secret: Optional[bool] = None,
kms_key_id: Optional[str] = None,
name: Optional[str] = None,
name_prefix: Optional[str] = None,
policy: Optional[str] = None,
recovery_window_in_days: Optional[int] = None,
region: Optional[str] = None,
replicas: Optional[Sequence[SecretReplicaArgs]] = None,
tags: Optional[Mapping[str, str]] = None,
tags_all: Optional[Mapping[str, str]] = None) -> Secret
func GetSecret(ctx *Context, name string, id IDInput, state *SecretState, opts ...ResourceOption) (*Secret, error)
public static Secret Get(string name, Input<string> id, SecretState? state, CustomResourceOptions? opts = null)
public static Secret get(String name, Output<String> id, SecretState state, CustomResourceOptions options)
resources: _: type: aws:secretsmanager:Secret get: id: ${id}
import {
to = aws_secretsmanager_secret.example
id = "${id}"
}
nameThis property is required.The unique name of the resulting resource.idThis property is required.The unique provider ID of the resource to lookup.stateAny extra arguments used during the lookup.optsA bag of options that control this resource's behavior.
resource_nameThis property is required.The unique name of the resulting resource.idThis property is required.The unique provider ID of the resource to lookup.
The following state arguments are supported:
ArnstringARN of the secret.DescriptionstringDescription of the secret.ForceOverwriteReplicaSecretboolAccepts boolean value to specify whether to overwrite a secret with the same name in the destination Region.KmsKeyIdstringARN or Id of the AWS KMS key to be used to encrypt the secret values in the versions stored in this secret. If you need to reference a CMK in a different account, you can use only the key ARN. If you don't specify this value, then Secrets Manager defaults to using the AWS account's default KMS key (the one named aws/secretsmanager). If the default KMS key with that name doesn't yet exist, then AWS Secrets Manager creates it for you automatically the first time.NameChanges to this property will trigger replacement.stringFriendly name of the new secret. The secret name can consist of uppercase letters, lowercase letters, digits, and any of the following characters: /_+=.@- Conflicts with namePrefix.NamePrefixChanges to this property will trigger replacement.stringCreates a unique name beginning with the specified prefix. Conflicts with name.PolicystringValid JSON document representing a resource policy. Removing policy from your configuration or setting policy to null or an empty string (i.e., policy = "") will not delete the policy since it could have been set by aws.secretsmanager.SecretPolicy. To delete the policy, set it to "{}" (an empty JSON document).RecoveryWindowInDaysintNumber of days that AWS Secrets Manager waits before it can delete the secret. This value can be 0 to force deletion without recovery or range from 7 to 30 days. The default value is 30.RegionstringRegion where this resource will be managed. Defaults to the Region set in the provider configuration.ReplicasListdefaultTags configuration block present, tags with matching keys will overwrite those defined at the provider-level.TagsAllDictionary<string, string>Map of tags assigned to the resource, including those inherited from the provider defaultTags configuration block.
ArnstringARN of the secret.DescriptionstringDescription of the secret.ForceOverwriteReplicaSecretboolAccepts boolean value to specify whether to overwrite a secret with the same name in the destination Region.KmsKeyIdstringARN or Id of the AWS KMS key to be used to encrypt the secret values in the versions stored in this secret. If you need to reference a CMK in a different account, you can use only the key ARN. If you don't specify this value, then Secrets Manager defaults to using the AWS account's default KMS key (the one named aws/secretsmanager). If the default KMS key with that name doesn't yet exist, then AWS Secrets Manager creates it for you automatically the first time.NameChanges to this property will trigger replacement.stringFriendly name of the new secret. The secret name can consist of uppercase letters, lowercase letters, digits, and any of the following characters: /_+=.@- Conflicts with namePrefix.NamePrefixChanges to this property will trigger replacement.stringCreates a unique name beginning with the specified prefix. Conflicts with name.PolicystringValid JSON document representing a resource policy. Removing policy from your configuration or setting policy to null or an empty string (i.e., policy = "") will not delete the policy since it could have been set by aws.secretsmanager.SecretPolicy. To delete the policy, set it to "{}" (an empty JSON document).RecoveryWindowInDaysintNumber of days that AWS Secrets Manager waits before it can delete the secret. This value can be 0 to force deletion without recovery or range from 7 to 30 days. The default value is 30.RegionstringRegion where this resource will be managed. Defaults to the Region set in the provider configuration.Replicas[]SecretReplicaArgsConfiguration block to support secret replication. See details below.Tagsmap[string]stringKey-value map of user-defined tags that are attached to the secret. If configured with a provider defaultTags configuration block present, tags with matching keys will overwrite those defined at the provider-level.TagsAllmap[string]stringMap of tags assigned to the resource, including those inherited from the provider defaultTags configuration block.
arnstringARN of the secret.descriptionstringDescription of the secret.force_overwrite_replica_secretboolAccepts boolean value to specify whether to overwrite a secret with the same name in the destination Region.kms_key_idstringARN or Id of the AWS KMS key to be used to encrypt the secret values in the versions stored in this secret. If you need to reference a CMK in a different account, you can use only the key ARN. If you don't specify this value, then Secrets Manager defaults to using the AWS account's default KMS key (the one named aws/secretsmanager). If the default KMS key with that name doesn't yet exist, then AWS Secrets Manager creates it for you automatically the first time.nameChanges to this property will trigger replacement.stringFriendly name of the new secret. The secret name can consist of uppercase letters, lowercase letters, digits, and any of the following characters: /_+=.@- Conflicts with namePrefix.name_prefixChanges to this property will trigger replacement.stringCreates a unique name beginning with the specified prefix. Conflicts with name.policystringValid JSON document representing a resource policy. Removing policy from your configuration or setting policy to null or an empty string (i.e., policy = "") will not delete the policy since it could have been set by aws.secretsmanager.SecretPolicy. To delete the policy, set it to "{}" (an empty JSON document).recovery_window_in_daysnumberNumber of days that AWS Secrets Manager waits before it can delete the secret. This value can be 0 to force deletion without recovery or range from 7 to 30 days. The default value is 30.regionstringRegion where this resource will be managed. Defaults to the Region set in the provider configuration.replicaslist(object)Configuration block to support secret replication. See details below.tagsmap(string)Key-value map of user-defined tags that are attached to the secret. If configured with a provider defaultTags configuration block present, tags with matching keys will overwrite those defined at the provider-level.tags_allmap(string)Map of tags assigned to the resource, including those inherited from the provider defaultTags configuration block.
arnStringARN of the secret.descriptionStringDescription of the secret.forceOverwriteReplicaSecretBooleanAccepts boolean value to specify whether to overwrite a secret with the same name in the destination Region.kmsKeyIdStringARN or Id of the AWS KMS key to be used to encrypt the secret values in the versions stored in this secret. If you need to reference a CMK in a different account, you can use only the key ARN. If you don't specify this value, then Secrets Manager defaults to using the AWS account's default KMS key (the one named aws/secretsmanager). If the default KMS key with that name doesn't yet exist, then AWS Secrets Manager creates it for you automatically the first time.nameChanges to this property will trigger replacement.StringFriendly name of the new secret. The secret name can consist of uppercase letters, lowercase letters, digits, and any of the following characters: /_+=.@- Conflicts with namePrefix.namePrefixChanges to this property will trigger replacement.StringCreates a unique name beginning with the specified prefix. Conflicts with name.policyStringValid JSON document representing a resource policy. Removing policy from your configuration or setting policy to null or an empty string (i.e., policy = "") will not delete the policy since it could have been set by aws.secretsmanager.SecretPolicy. To delete the policy, set it to "{}" (an empty JSON document).recoveryWindowInDaysIntegerNumber of days that AWS Secrets Manager waits before it can delete the secret. This value can be 0 to force deletion without recovery or range from 7 to 30 days. The default value is 30.regionStringRegion where this resource will be managed. Defaults to the Region set in the provider configuration.replicasListdefaultTags configuration block present, tags with matching keys will overwrite those defined at the provider-level.tagsAllMap<String,String>Map of tags assigned to the resource, including those inherited from the provider defaultTags configuration block.
arnstringARN of the secret.descriptionstringDescription of the secret.forceOverwriteReplicaSecretbooleanAccepts boolean value to specify whether to overwrite a secret with the same name in the destination Region.kmsKeyIdstringARN or Id of the AWS KMS key to be used to encrypt the secret values in the versions stored in this secret. If you need to reference a CMK in a different account, you can use only the key ARN. If you don't specify this value, then Secrets Manager defaults to using the AWS account's default KMS key (the one named aws/secretsmanager). If the default KMS key with that name doesn't yet exist, then AWS Secrets Manager creates it for you automatically the first time.nameChanges to this property will trigger replacement.stringFriendly name of the new secret. The secret name can consist of uppercase letters, lowercase letters, digits, and any of the following characters: /_+=.@- Conflicts with namePrefix.namePrefixChanges to this property will trigger replacement.stringCreates a unique name beginning with the specified prefix. Conflicts with name.policystringValid JSON document representing a resource policy. Removing policy from your configuration or setting policy to null or an empty string (i.e., policy = "") will not delete the policy since it could have been set by aws.secretsmanager.SecretPolicy. To delete the policy, set it to "{}" (an empty JSON document).recoveryWindowInDaysnumberNumber of days that AWS Secrets Manager waits before it can delete the secret. This value can be 0 to force deletion without recovery or range from 7 to 30 days. The default value is 30.regionstringRegion where this resource will be managed. Defaults to the Region set in the provider configuration.replicasSecretReplica[]Configuration block to support secret replication. See details below.tags{[key: string]: string}Key-value map of user-defined tags that are attached to the secret. If configured with a provider defaultTags configuration block present, tags with matching keys will overwrite those defined at the provider-level.tagsAll{[key: string]: string}Map of tags assigned to the resource, including those inherited from the provider defaultTags configuration block.
arnstrARN of the secret.descriptionstrDescription of the secret.force_overwrite_replica_secretboolAccepts boolean value to specify whether to overwrite a secret with the same name in the destination Region.kms_key_idstrARN or Id of the AWS KMS key to be used to encrypt the secret values in the versions stored in this secret. If you need to reference a CMK in a different account, you can use only the key ARN. If you don't specify this value, then Secrets Manager defaults to using the AWS account's default KMS key (the one named aws/secretsmanager). If the default KMS key with that name doesn't yet exist, then AWS Secrets Manager creates it for you automatically the first time.nameChanges to this property will trigger replacement.strFriendly name of the new secret. The secret name can consist of uppercase letters, lowercase letters, digits, and any of the following characters: /_+=.@- Conflicts with namePrefix.name_prefixChanges to this property will trigger replacement.strCreates a unique name beginning with the specified prefix. Conflicts with name.policystrValid JSON document representing a resource policy. Removing policy from your configuration or setting policy to null or an empty string (i.e., policy = "") will not delete the policy since it could have been set by aws.secretsmanager.SecretPolicy. To delete the policy, set it to "{}" (an empty JSON document).recovery_window_in_daysintNumber of days that AWS Secrets Manager waits before it can delete the secret. This value can be 0 to force deletion without recovery or range from 7 to 30 days. The default value is 30.regionstrRegion where this resource will be managed. Defaults to the Region set in the provider configuration.replicasSequence[SecretReplicaArgs]Configuration block to support secret replication. See details below.tagsMapping[str, str]Key-value map of user-defined tags that are attached to the secret. If configured with a provider defaultTags configuration block present, tags with matching keys will overwrite those defined at the provider-level.tags_allMapping[str, str]Map of tags assigned to the resource, including those inherited from the provider defaultTags configuration block.
arnStringARN of the secret.descriptionStringDescription of the secret.forceOverwriteReplicaSecretBooleanAccepts boolean value to specify whether to overwrite a secret with the same name in the destination Region.kmsKeyIdStringARN or Id of the AWS KMS key to be used to encrypt the secret values in the versions stored in this secret. If you need to reference a CMK in a different account, you can use only the key ARN. If you don't specify this value, then Secrets Manager defaults to using the AWS account's default KMS key (the one named aws/secretsmanager). If the default KMS key with that name doesn't yet exist, then AWS Secrets Manager creates it for you automatically the first time.nameChanges to this property will trigger replacement.StringFriendly name of the new secret. The secret name can consist of uppercase letters, lowercase letters, digits, and any of the following characters: /_+=.@- Conflicts with namePrefix.namePrefixChanges to this property will trigger replacement.StringCreates a unique name beginning with the specified prefix. Conflicts with name.policyStringValid JSON document representing a resource policy. Removing policy from your configuration or setting policy to null or an empty string (i.e., policy = "") will not delete the policy since it could have been set by aws.secretsmanager.SecretPolicy. To delete the policy, set it to "{}" (an empty JSON document).recoveryWindowInDaysNumberNumber of days that AWS Secrets Manager waits before it can delete the secret. This value can be 0 to force deletion without recovery or range from 7 to 30 days. The default value is 30.regionStringRegion where this resource will be managed. Defaults to the Region set in the provider configuration.replicasListdefaultTags configuration block present, tags with matching keys will overwrite those defined at the provider-level.tagsAllMapdefaultTags configuration block.
Supporting Types Anchor
SecretReplica , SecretReplicaArgs Anchor
RegionThis property is required.stringRegion for replicating the secret.KmsKeyIdstringARN, Key ID, or Alias of the AWS KMS key within the region secret is replicated to. If one is not specified, then Secrets Manager defaults to using the AWS account's default KMS key (aws/secretsmanager) in the region or creates one for use if non-existent.LastAccessedDatestringDate that you last accessed the secret in the Region.StatusstringStatus can be InProgress, Failed, or InSync.StatusMessagestringMessage such as Replication succeeded or Secret with this name already exists in this region.
RegionThis property is required.stringRegion for replicating the secret.KmsKeyIdstringARN, Key ID, or Alias of the AWS KMS key within the region secret is replicated to. If one is not specified, then Secrets Manager defaults to using the AWS account's default KMS key (aws/secretsmanager) in the region or creates one for use if non-existent.LastAccessedDatestringDate that you last accessed the secret in the Region.StatusstringStatus can be InProgress, Failed, or InSync.StatusMessagestringMessage such as Replication succeeded or Secret with this name already exists in this region.
regionThis property is required.stringRegion for replicating the secret.kms_key_idstringARN, Key ID, or Alias of the AWS KMS key within the region secret is replicated to. If one is not specified, then Secrets Manager defaults to using the AWS account's default KMS key (aws/secretsmanager) in the region or creates one for use if non-existent.last_accessed_datestringDate that you last accessed the secret in the Region.statusstringStatus can be InProgress, Failed, or InSync.status_messagestringMessage such as Replication succeeded or Secret with this name already exists in this region.
regionThis property is required.StringRegion for replicating the secret.kmsKeyIdStringARN, Key ID, or Alias of the AWS KMS key within the region secret is replicated to. If one is not specified, then Secrets Manager defaults to using the AWS account's default KMS key (aws/secretsmanager) in the region or creates one for use if non-existent.lastAccessedDateStringDate that you last accessed the secret in the Region.statusStringStatus can be InProgress, Failed, or InSync.statusMessageStringMessage such as Replication succeeded or Secret with this name already exists in this region.
regionThis property is required.stringRegion for replicating the secret.kmsKeyIdstringARN, Key ID, or Alias of the AWS KMS key within the region secret is replicated to. If one is not specified, then Secrets Manager defaults to using the AWS account's default KMS key (aws/secretsmanager) in the region or creates one for use if non-existent.lastAccessedDatestringDate that you last accessed the secret in the Region.statusstringStatus can be InProgress, Failed, or InSync.statusMessagestringMessage such as Replication succeeded or Secret with this name already exists in this region.
regionThis property is required.strRegion for replicating the secret.kms_key_idstrARN, Key ID, or Alias of the AWS KMS key within the region secret is replicated to. If one is not specified, then Secrets Manager defaults to using the AWS account's default KMS key (aws/secretsmanager) in the region or creates one for use if non-existent.last_accessed_datestrDate that you last accessed the secret in the Region.statusstrStatus can be InProgress, Failed, or InSync.status_messagestrMessage such as Replication succeeded or Secret with this name already exists in this region.
regionThis property is required.StringRegion for replicating the secret.kmsKeyIdStringARN, Key ID, or Alias of the AWS KMS key within the region secret is replicated to. If one is not specified, then Secrets Manager defaults to using the AWS account's default KMS key (aws/secretsmanager) in the region or creates one for use if non-existent.lastAccessedDateStringDate that you last accessed the secret in the Region.statusStringStatus can be InProgress, Failed, or InSync.statusMessageStringMessage such as Replication succeeded or Secret with this name already exists in this region.
Import Anchor
Identity Schema Anchor
Required Anchor
arn(String) Amazon Resource Name (ARN) of the Secrets Manager secret.
Using pulumi import, import aws.secretsmanager.Secret using the secret Amazon Resource Name (ARN). For example:
$ pulumi import aws:secretsmanager/secret:Secret example arn:aws:secretsmanager:us-east-1:123456789012:secret:example-123456
Copy
To learn more about importing existing cloud resources, see Importing resources.
Package Details Anchor
Viewing docs for AWS v7.32.0
published on Friday, May 29, 2026 by Pulumi
v7.32.0 (7.x, latest)v6.83.1 (6.x)v5.43.0 (5.x)
On this page
On this page
Related Resources
- Copy Page
[Scroll to top](/content/registry/packages/aws/api-docs/secretsmanager/secret/# "Scroll to top"/index.html)