Get a detailed overview of this resourceList the top 5 use cases for this resourceBuild a program using aws.secretsmanager.SecretRepository[AWS Classic pulumi/pulumi-aws](https://github.com/pulumi/pulumi-aws)LicenseApache-2.0NotesThis Pulumi package is based on the [`aws` Terraform Provider](https://github.com/hashicorp/terraform-provider-aws). 1. [Packages](/content/registry/index.html) 2. [Packages](/content/registry/packages/index.html) 3. [AWS](/content/registry/packages/aws/index.html) 4. [API Docs](/content/registry/packages/aws/api-docs/index.html) 5. [secretsmanager](/content/registry/packages/aws/api-docs/secretsmanager/index.html) 6. [Secret](/content/registry/packages/aws/api-docs/secretsmanager/secret/index.html) AWS v7.32.0, May 29 26 AWS v7.32.0, May 29 26 Viewing docs for AWS v7.32.0 published on Friday, May 29, 2026 by Pulumi [Schema (JSON)](/content/registry/packages/aws/schema.json) [pulumi/pulumi-aws](https://github.com/pulumi/pulumi-aws) v7.32.0 (7.x, latest)v6.83.1 (6.x)v5.43.0 (5.x) # aws.secretsmanager.Secret [Anchor](/content/registry/packages/aws/api-docs/secretsmanager/secret/\#aws-secretsmanager-secret/index.html) Explore with Neo [Explain this resource](https://app.pulumi.com/neo?prompt=Explain+the+resource+aws.secretsmanager.Secret.+Provide+a+detailed+overview+of+its+purpose%2C+architecture%2C+and+typical+responsibilities.&prefer_signup=true) [Show real-world scenarios](https://app.pulumi.com/neo?prompt=List+the+top+five+real-world+scenarios+where+aws.secretsmanager.Secret+delivers+the+most+value.+Describe+why+it+is+useful+for+each.&prefer_signup=true) [Provision a new instance](https://app.pulumi.com/neo?prompt=Generate+a+Pulumi+program+that+provisions+aws.secretsmanager.Secret.+Include+any+required+configuration+and+showcase+best+practices.&prefer_signup=true) Viewing docs for AWS v7.32.0 published on Friday, May 29, 2026 by Pulumi [Schema (JSON)](/content/registry/packages/aws/schema.json) [pulumi/pulumi-aws](https://github.com/pulumi/pulumi-aws) v7.32.0 (7.x, latest)v6.83.1 (6.x)v5.43.0 (5.x) ## On this page ## On this page - [Example Usage](/content/registry/packages/aws/api-docs/secretsmanager/secret/#example-usage/index.html) - [Basic](/content/registry/packages/aws/api-docs/secretsmanager/secret/#basic/index.html) - [Create Secret Resource](/content/registry/packages/aws/api-docs/secretsmanager/secret/#create/index.html) - [Constructor syntax](/content/registry/packages/aws/api-docs/secretsmanager/secret/#constructor-syntax/index.html) - [Constructor example](/content/registry/packages/aws/api-docs/secretsmanager/secret/#constructor-example/index.html) - [Secret Resource Properties](/content/registry/packages/aws/api-docs/secretsmanager/secret/#properties/index.html) - [Inputs](/content/registry/packages/aws/api-docs/secretsmanager/secret/#inputs/index.html) - [Outputs](/content/registry/packages/aws/api-docs/secretsmanager/secret/#outputs/index.html) - [Look up Existing Secret Resource](/content/registry/packages/aws/api-docs/secretsmanager/secret/#look-up/index.html) - [Supporting Types](/content/registry/packages/aws/api-docs/secretsmanager/secret/#supporting-types/index.html) - [Import](/content/registry/packages/aws/api-docs/secretsmanager/secret/#import/index.html) - [Identity Schema](/content/registry/packages/aws/api-docs/secretsmanager/secret/#identity-schema/index.html) - [Package Details](/content/registry/packages/aws/api-docs/secretsmanager/secret/#package-details/index.html) * * * Related Resources [secretsmanager.SecretVersion](/content/registry/packages/aws/api-docs/secretsmanager/secretversion/index.html) [ecs.TaskDefinition](/content/registry/packages/aws/api-docs/ecs/taskdefinition/index.html) [lambda.Function](/content/registry/packages/aws/api-docs/lambda/function/index.html) [iam.Policy](/content/registry/packages/aws/api-docs/iam/policy/index.html) [iam.RolePolicy](/content/registry/packages/aws/api-docs/iam/rolepolicy/index.html) [rds.Proxy](/content/registry/packages/aws/api-docs/rds/proxy/index.html) [iam.Role](/content/registry/packages/aws/api-docs/iam/role/index.html) - Copy Page - [Request a Change](https://github.com/pulumi/registry/issues/new?body=File:%20[themes%2fdefault%2fcontent/%2fregistry%2fpackages%2faws%2fapi-docs%2fsecretsmanager%2fsecret](https%3a%2f%2fwww.pulumi.com%2fregistry%2fpackages%2faws%2fapi-docs%2fsecretsmanager%2fsecret%2f)) [Scroll to top](/content/registry/packages/aws/api-docs/secretsmanager/secret/# "Scroll to top"/index.html) Provides a resource to manage AWS Secrets Manager secret metadata. To manage secret rotation, see the `aws.secretsmanager.SecretRotation` resource. To manage a secret value, see the `aws.secretsmanager.SecretVersion` resource. ## Example Usage [Anchor](/content/registry/packages/aws/api-docs/secretsmanager/secret/\#example-usage/index.html) ### Basic [Anchor](/content/registry/packages/aws/api-docs/secretsmanager/secret/\#basic/index.html) - TypeScript - Python - Go - C# - Java - YAML - HCL PREVIEW ```typescript import * as pulumi from "@pulumi/pulumi"; import * as aws from "@pulumi/aws"; const example = new aws.secretsmanager.Secret("example", {name: "example"}); ``` Copy ```python import pulumi import pulumi_aws as aws example = aws.secretsmanager.Secret("example", name="example") ``` Copy ```go package main import ( "github.com/pulumi/pulumi-aws/sdk/v7/go/aws/secretsmanager" "github.com/pulumi/pulumi/sdk/v3/go/pulumi" ) func main() { pulumi.Run(func(ctx *pulumi.Context) error { _, err := secretsmanager.NewSecret(ctx, "example", &secretsmanager.SecretArgs{ Name: pulumi.String("example"), }) if err != nil { return err } return nil }) } ``` Copy ```csharp using System.Collections.Generic; using System.Linq; using Pulumi; using Aws = Pulumi.Aws; return await Deployment.RunAsync(() => { var example = new Aws.SecretsManager.Secret("example", new() { Name = "example", }); }); ``` Copy ```java package generated_program; import com.pulumi.Context; import com.pulumi.Pulumi; import com.pulumi.core.Output; import com.pulumi.aws.secretsmanager.Secret; import com.pulumi.aws.secretsmanager.SecretArgs; import java.util.ArrayList; import java.util.Arrays; import java.util.Map; import java.io.File; import java.nio.file.Files; import java.nio.file.Paths; public class App { public static void main(String[] args) { Pulumi.run(App::stack); } public static void stack(Context ctx) { var example = new Secret("example", SecretArgs.builder() .name("example") .build()); } } ``` Copy ```yaml resources: example: type: aws:secretsmanager:Secret properties: name: example ``` Copy ```hcl pulumi { required_providers { aws = { source = "pulumi/aws" } } } resource "aws_secretsmanager_secret" "example" { name = "example" } ``` Copy ## Create Secret Resource [Anchor](/content/registry/packages/aws/api-docs/secretsmanager/secret/\#create/index.html) Resources are created with functions called constructors. To learn more about declaring and configuring resources, see [Resources](/content/docs/concepts/resources/index.html). ### Constructor syntax [Anchor](/content/registry/packages/aws/api-docs/secretsmanager/secret/\#constructor-syntax/index.html) - TypeScript - Python - Go - C# - Java - YAML - HCL PREVIEW ```typescript new Secret(name: string, args?: SecretArgs, opts?: CustomResourceOptions); ``` ```python @overload def Secret(resource_name: str, args: Optional[SecretArgs] = None, opts: Optional[ResourceOptions] = None) @overload def Secret(resource_name: str, opts: Optional[ResourceOptions] = None, description: Optional[str] = None, force_overwrite_replica_secret: Optional[bool] = None, kms_key_id: Optional[str] = None, name: Optional[str] = None, name_prefix: Optional[str] = None, policy: Optional[str] = None, recovery_window_in_days: Optional[int] = None, region: Optional[str] = None, replicas: Optional[Sequence[SecretReplicaArgs]] = None, tags: Optional[Mapping[str, str]] = None) ``` ```go func NewSecret(ctx *Context, name string, args *SecretArgs, opts ...ResourceOption) (*Secret, error) ``` ```csharp public Secret(string name, SecretArgs? args = null, CustomResourceOptions? opts = null) ``` ```java public Secret(String name, SecretArgs args) public Secret(String name, SecretArgs args, CustomResourceOptions options) ``` ```yaml type: aws:secretsmanager:Secret properties: # The arguments to resource properties. options: # Bag of options to control resource's behavior. ``` ```hcl resource "aws_secretsmanager_secret" "name" { # resource properties } ``` #### Parameters [Anchor](/content/registry/packages/aws/api-docs/secretsmanager/secret/\#parameters/index.html) nameThis property is required.stringThe unique name of the resource.args[SecretArgs](/content/registry/packages/aws/api-docs/secretsmanager/secret/#inputs/index.html)The arguments to resource properties.opts[CustomResourceOptions](/content/docs/reference/pkg/nodejs/pulumi/pulumi/#CustomResourceOptions/index.html)Bag of options to control resource's behavior. resource\_nameThis property is required.strThe unique name of the resource.args[SecretArgs](/content/registry/packages/aws/api-docs/secretsmanager/secret/#inputs/index.html)The arguments to resource properties.opts[ResourceOptions](/content/docs/reference/pkg/python/pulumi/#pulumi.ResourceOptions)Bag of options to control resource's behavior. ctx[Context](https://pkg.go.dev/github.com/pulumi/pulumi/sdk/v3/go/pulumi?tab=doc#Context)Context object for the current deployment.nameThis property is required.stringThe unique name of the resource.args[SecretArgs](/content/registry/packages/aws/api-docs/secretsmanager/secret/#inputs/index.html)The arguments to resource properties.opts[ResourceOption](https://pkg.go.dev/github.com/pulumi/pulumi/sdk/v3/go/pulumi?tab=doc#ResourceOption)Bag of options to control resource's behavior. nameThis property is required.stringThe unique name of the resource.args[SecretArgs](/content/registry/packages/aws/api-docs/secretsmanager/secret/#inputs/index.html)The arguments to resource properties.opts[CustomResourceOptions](/content/docs/reference/pkg/dotnet/Pulumi/Pulumi.CustomResourceOptions.html)Bag of options to control resource's behavior. nameThis property is required.StringThe unique name of the resource.argsThis property is required.[SecretArgs](/content/registry/packages/aws/api-docs/secretsmanager/secret/#inputs/index.html)The arguments to resource properties.optionsCustomResourceOptionsBag of options to control resource's behavior. ### Constructor example [Anchor](/content/registry/packages/aws/api-docs/secretsmanager/secret/\#constructor-example/index.html) The following reference example uses placeholder values for all [input properties](/content/registry/packages/aws/api-docs/secretsmanager/secret/#inputs/index.html). - TypeScript - Python - Go - C# - Java - YAML - HCL PREVIEW ```csharp var secretResource = new Aws.SecretsManager.Secret("secretResource", new() { Description = "string", ForceOverwriteReplicaSecret = false, KmsKeyId = "string", Name = "string", NamePrefix = "string", Policy = "string", RecoveryWindowInDays = 0, Region = "string", Replicas = new[] { new Aws.SecretsManager.Inputs.SecretReplicaArgs { Region = "string", KmsKeyId = "string", LastAccessedDate = "string", Status = "string", StatusMessage = "string", }, }, Tags = { { "string", "string" }, }, }); ``` Copy ```go example, err := secretsmanager.NewSecret(ctx, "secretResource", &secretsmanager.SecretArgs{ Description: pulumi.String("string"), ForceOverwriteReplicaSecret: pulumi.Bool(false), KmsKeyId: pulumi.String("string"), Name: pulumi.String("string"), NamePrefix: pulumi.String("string"), Policy: pulumi.String("string"), RecoveryWindowInDays: pulumi.Int(0), Region: pulumi.String("string"), Replicas: secretsmanager.SecretReplicaArray{ &secretsmanager.SecretReplicaArgs{ Region: pulumi.String("string"), KmsKeyId: pulumi.String("string"), LastAccessedDate: pulumi.String("string"), Status: pulumi.String("string"), StatusMessage: pulumi.String("string"), }, }, Tags: pulumi.StringMap{ "string": pulumi.String("string"), }, }) ``` Copy ```hcl resource "aws_secretsmanager_secret" "secretResource" { description = "string" force_overwrite_replica_secret = false kms_key_id = "string" name = "string" name_prefix = "string" policy = "string" recovery_window_in_days = 0 region = "string" replicas { region = "string" kms_key_id = "string" last_accessed_date = "string" status = "string" status_message = "string" } tags = { "string" = "string" } } ``` Copy ```java var secretResource = new Secret("secretResource", SecretArgs.builder() .description("string") .forceOverwriteReplicaSecret(false) .kmsKeyId("string") .name("string") .namePrefix("string") .policy("string") .recoveryWindowInDays(0) .region("string") .replicas(SecretReplicaArgs.builder() .region("string") .kmsKeyId("string") .lastAccessedDate("string") .status("string") .statusMessage("string") .build()) .tags(Map.of("string", "string")) .build()); ``` Copy ```python secret_resource = aws.secretsmanager.Secret("secretResource", description="string", force_overwrite_replica_secret=False, kms_key_id="string", name="string", name_prefix="string", policy="string", recovery_window_in_days=0, region="string", replicas=[{\ "region": "string",\ "kms_key_id": "string",\ "last_accessed_date": "string",\ "status": "string",\ "status_message": "string",\ }], tags={ "string": "string", }) ``` Copy ```typescript const secretResource = new aws.secretsmanager.Secret("secretResource", { description: "string", forceOverwriteReplicaSecret: false, kmsKeyId: "string", name: "string", namePrefix: "string", policy: "string", recoveryWindowInDays: 0, region: "string", replicas: [{\ region: "string",\ kmsKeyId: "string",\ lastAccessedDate: "string",\ status: "string",\ statusMessage: "string",\ }], tags: { string: "string", }, }); ``` Copy ```yaml type: aws:secretsmanager:Secret properties: description: string forceOverwriteReplicaSecret: false kmsKeyId: string name: string namePrefix: string policy: string recoveryWindowInDays: 0 region: string replicas: - kmsKeyId: string lastAccessedDate: string region: string status: string statusMessage: string tags: string: string ``` Copy ## Secret Resource Properties [Anchor](/content/registry/packages/aws/api-docs/secretsmanager/secret/\#properties/index.html) To learn more about resource properties and how to use them, see [Inputs and Outputs](/content/docs/intro/concepts/inputs-outputs/index.html) in the Architecture and Concepts docs. ### Inputs [Anchor](/content/registry/packages/aws/api-docs/secretsmanager/secret/\#inputs/index.html) In Python, inputs that are objects can be passed either as [argument classes or as dictionary literals](/content/docs/languages-sdks/python/#inputs-and-outputs/index.html). The Secret resource accepts the following [input](/content/docs/intro/concepts/inputs-outputs/index.html) properties: [Description](/content/registry/packages/aws/api-docs/secretsmanager/secret/#description_csharp/index.html)stringDescription of the secret.[ForceOverwriteReplicaSecret](/content/registry/packages/aws/api-docs/secretsmanager/secret/#forceoverwritereplicasecret_csharp/index.html)boolAccepts boolean value to specify whether to overwrite a secret with the same name in the destination Region.[KmsKeyId](/content/registry/packages/aws/api-docs/secretsmanager/secret/#kmskeyid_csharp/index.html)stringARN or Id of the AWS KMS key to be used to encrypt the secret values in the versions stored in this secret. If you need to reference a CMK in a different account, you can use only the key ARN. If you don't specify this value, then Secrets Manager defaults to using the AWS account's default KMS key (the one named `aws/secretsmanager`). If the default KMS key with that name doesn't yet exist, then AWS Secrets Manager creates it for you automatically the first time.[Name](/content/registry/packages/aws/api-docs/secretsmanager/secret/#name_csharp/index.html)Changes to this property will trigger replacement.stringFriendly name of the new secret. The secret name can consist of uppercase letters, lowercase letters, digits, and any of the following characters: `/_+=.@-` Conflicts with `namePrefix`.[NamePrefix](/content/registry/packages/aws/api-docs/secretsmanager/secret/#nameprefix_csharp/index.html)Changes to this property will trigger replacement.stringCreates a unique name beginning with the specified prefix. Conflicts with `name`.[Policy](/content/registry/packages/aws/api-docs/secretsmanager/secret/#policy_csharp/index.html)stringValid JSON document representing a [resource policy](https://docs.aws.amazon.com/secretsmanager/latest/userguide/auth-and-access_resource-based-policies.html). Removing `policy` from your configuration or setting `policy` to null or an empty string (i.e., `policy = ""`) _will not_ delete the policy since it could have been set by `aws.secretsmanager.SecretPolicy`. To delete the `policy`, set it to `"{}"` (an empty JSON document).[RecoveryWindowInDays](/content/registry/packages/aws/api-docs/secretsmanager/secret/#recoverywindowindays_csharp/index.html)intNumber of days that AWS Secrets Manager waits before it can delete the secret. This value can be `0` to force deletion without recovery or range from `7` to `30` days. The default value is `30`.[Region](/content/registry/packages/aws/api-docs/secretsmanager/secret/#region_csharp/index.html)stringRegion where this resource will be [managed](https://docs.aws.amazon.com/general/latest/gr/rande.html#regional-endpoints). Defaults to the Region set in the provider configuration.[Replicas](/content/registry/packages/aws/api-docs/secretsmanager/secret/#replicas_csharp/index.html)[List](/content/registry/packages/aws/api-docs/secretsmanager/secret/#secretreplica/index.html)Configuration block to support secret replication. See details below.[Tags](/content/registry/packages/aws/api-docs/secretsmanager/secret/#tags_csharp/index.html)DictionaryKey-value map of user-defined tags that are attached to the secret. If configured with a provider `defaultTags` configuration block present, tags with matching keys will overwrite those defined at the provider-level. [Description](/content/registry/packages/aws/api-docs/secretsmanager/secret/#description_go/index.html)stringDescription of the secret.[ForceOverwriteReplicaSecret](/content/registry/packages/aws/api-docs/secretsmanager/secret/#forceoverwritereplicasecret_go/index.html)boolAccepts boolean value to specify whether to overwrite a secret with the same name in the destination Region.[KmsKeyId](/content/registry/packages/aws/api-docs/secretsmanager/secret/#kmskeyid_go/index.html)stringARN or Id of the AWS KMS key to be used to encrypt the secret values in the versions stored in this secret. If you need to reference a CMK in a different account, you can use only the key ARN. If you don't specify this value, then Secrets Manager defaults to using the AWS account's default KMS key (the one named `aws/secretsmanager`). If the default KMS key with that name doesn't yet exist, then AWS Secrets Manager creates it for you automatically the first time.[Name](/content/registry/packages/aws/api-docs/secretsmanager/secret/#name_go/index.html)Changes to this property will trigger replacement.stringFriendly name of the new secret. The secret name can consist of uppercase letters, lowercase letters, digits, and any of the following characters: `/_+=.@-` Conflicts with `namePrefix`.[NamePrefix](/content/registry/packages/aws/api-docs/secretsmanager/secret/#nameprefix_go/index.html)Changes to this property will trigger replacement.stringCreates a unique name beginning with the specified prefix. Conflicts with `name`.[Policy](/content/registry/packages/aws/api-docs/secretsmanager/secret/#policy_go/index.html)stringValid JSON document representing a [resource policy](https://docs.aws.amazon.com/secretsmanager/latest/userguide/auth-and-access_resource-based-policies.html). Removing `policy` from your configuration or setting `policy` to null or an empty string (i.e., `policy = ""`) _will not_ delete the policy since it could have been set by `aws.secretsmanager.SecretPolicy`. To delete the `policy`, set it to `"{}"` (an empty JSON document).[RecoveryWindowInDays](/content/registry/packages/aws/api-docs/secretsmanager/secret/#recoverywindowindays_go/index.html)intNumber of days that AWS Secrets Manager waits before it can delete the secret. This value can be `0` to force deletion without recovery or range from `7` to `30` days. The default value is `30`.[Region](/content/registry/packages/aws/api-docs/secretsmanager/secret/#region_go/index.html)stringRegion where this resource will be [managed](https://docs.aws.amazon.com/general/latest/gr/rande.html#regional-endpoints). Defaults to the Region set in the provider configuration.[Replicas](/content/registry/packages/aws/api-docs/secretsmanager/secret/#replicas_go/index.html)[\[\]SecretReplicaArgs](/content/registry/packages/aws/api-docs/secretsmanager/secret/#secretreplica/index.html)Configuration block to support secret replication. See details below.[Tags](/content/registry/packages/aws/api-docs/secretsmanager/secret/#tags_go/index.html)map\[string\]stringKey-value map of user-defined tags that are attached to the secret. If configured with a provider `defaultTags` configuration block present, tags with matching keys will overwrite those defined at the provider-level. [description](/content/registry/packages/aws/api-docs/secretsmanager/secret/#description_hcl/index.html)stringDescription of the secret.[force\_overwrite\_replica\_secret](/content/registry/packages/aws/api-docs/secretsmanager/secret/#force_overwrite_replica_secret_hcl/index.html)boolAccepts boolean value to specify whether to overwrite a secret with the same name in the destination Region.[kms\_key\_id](/content/registry/packages/aws/api-docs/secretsmanager/secret/#kms_key_id_hcl/index.html)stringARN or Id of the AWS KMS key to be used to encrypt the secret values in the versions stored in this secret. If you need to reference a CMK in a different account, you can use only the key ARN. If you don't specify this value, then Secrets Manager defaults to using the AWS account's default KMS key (the one named `aws/secretsmanager`). If the default KMS key with that name doesn't yet exist, then AWS Secrets Manager creates it for you automatically the first time.[name](/content/registry/packages/aws/api-docs/secretsmanager/secret/#name_hcl/index.html)Changes to this property will trigger replacement.stringFriendly name of the new secret. The secret name can consist of uppercase letters, lowercase letters, digits, and any of the following characters: `/_+=.@-` Conflicts with `namePrefix`.[name\_prefix](/content/registry/packages/aws/api-docs/secretsmanager/secret/#name_prefix_hcl/index.html)Changes to this property will trigger replacement.stringCreates a unique name beginning with the specified prefix. Conflicts with `name`.[policy](/content/registry/packages/aws/api-docs/secretsmanager/secret/#policy_hcl/index.html)stringValid JSON document representing a [resource policy](https://docs.aws.amazon.com/secretsmanager/latest/userguide/auth-and-access_resource-based-policies.html). Removing `policy` from your configuration or setting `policy` to null or an empty string (i.e., `policy = ""`) _will not_ delete the policy since it could have been set by `aws.secretsmanager.SecretPolicy`. To delete the `policy`, set it to `"{}"` (an empty JSON document).[recovery\_window\_in\_days](/content/registry/packages/aws/api-docs/secretsmanager/secret/#recovery_window_in_days_hcl/index.html)numberNumber of days that AWS Secrets Manager waits before it can delete the secret. This value can be `0` to force deletion without recovery or range from `7` to `30` days. The default value is `30`.[region](/content/registry/packages/aws/api-docs/secretsmanager/secret/#region_hcl/index.html)stringRegion where this resource will be [managed](https://docs.aws.amazon.com/general/latest/gr/rande.html#regional-endpoints). Defaults to the Region set in the provider configuration.[replicas](/content/registry/packages/aws/api-docs/secretsmanager/secret/#replicas_hcl/index.html)[list(object)](/content/registry/packages/aws/api-docs/secretsmanager/secret/#secretreplica/index.html)Configuration block to support secret replication. See details below.[tags](/content/registry/packages/aws/api-docs/secretsmanager/secret/#tags_hcl/index.html)map(string)Key-value map of user-defined tags that are attached to the secret. If configured with a provider `defaultTags` configuration block present, tags with matching keys will overwrite those defined at the provider-level. [description](/content/registry/packages/aws/api-docs/secretsmanager/secret/#description_java/index.html)StringDescription of the secret.[forceOverwriteReplicaSecret](/content/registry/packages/aws/api-docs/secretsmanager/secret/#forceoverwritereplicasecret_java/index.html)BooleanAccepts boolean value to specify whether to overwrite a secret with the same name in the destination Region.[kmsKeyId](/content/registry/packages/aws/api-docs/secretsmanager/secret/#kmskeyid_java/index.html)StringARN or Id of the AWS KMS key to be used to encrypt the secret values in the versions stored in this secret. If you need to reference a CMK in a different account, you can use only the key ARN. If you don't specify this value, then Secrets Manager defaults to using the AWS account's default KMS key (the one named `aws/secretsmanager`). If the default KMS key with that name doesn't yet exist, then AWS Secrets Manager creates it for you automatically the first time.[name](/content/registry/packages/aws/api-docs/secretsmanager/secret/#name_java/index.html)Changes to this property will trigger replacement.StringFriendly name of the new secret. The secret name can consist of uppercase letters, lowercase letters, digits, and any of the following characters: `/_+=.@-` Conflicts with `namePrefix`.[namePrefix](/content/registry/packages/aws/api-docs/secretsmanager/secret/#nameprefix_java/index.html)Changes to this property will trigger replacement.StringCreates a unique name beginning with the specified prefix. Conflicts with `name`.[policy](/content/registry/packages/aws/api-docs/secretsmanager/secret/#policy_java/index.html)StringValid JSON document representing a [resource policy](https://docs.aws.amazon.com/secretsmanager/latest/userguide/auth-and-access_resource-based-policies.html). Removing `policy` from your configuration or setting `policy` to null or an empty string (i.e., `policy = ""`) _will not_ delete the policy since it could have been set by `aws.secretsmanager.SecretPolicy`. To delete the `policy`, set it to `"{}"` (an empty JSON document).[recoveryWindowInDays](/content/registry/packages/aws/api-docs/secretsmanager/secret/#recoverywindowindays_java/index.html)IntegerNumber of days that AWS Secrets Manager waits before it can delete the secret. This value can be `0` to force deletion without recovery or range from `7` to `30` days. The default value is `30`.[region](/content/registry/packages/aws/api-docs/secretsmanager/secret/#region_java/index.html)StringRegion where this resource will be [managed](https://docs.aws.amazon.com/general/latest/gr/rande.html#regional-endpoints). Defaults to the Region set in the provider configuration.[replicas](/content/registry/packages/aws/api-docs/secretsmanager/secret/#replicas_java/index.html)[List](/content/registry/packages/aws/api-docs/secretsmanager/secret/#secretreplica/index.html)Configuration block to support secret replication. See details below.[tags](/content/registry/packages/aws/api-docs/secretsmanager/secret/#tags_java/index.html)MapKey-value map of user-defined tags that are attached to the secret. If configured with a provider `defaultTags` configuration block present, tags with matching keys will overwrite those defined at the provider-level. [description](/content/registry/packages/aws/api-docs/secretsmanager/secret/#description_nodejs/index.html)stringDescription of the secret.[forceOverwriteReplicaSecret](/content/registry/packages/aws/api-docs/secretsmanager/secret/#forceoverwritereplicasecret_nodejs/index.html)booleanAccepts boolean value to specify whether to overwrite a secret with the same name in the destination Region.[kmsKeyId](/content/registry/packages/aws/api-docs/secretsmanager/secret/#kmskeyid_nodejs/index.html)stringARN or Id of the AWS KMS key to be used to encrypt the secret values in the versions stored in this secret. If you need to reference a CMK in a different account, you can use only the key ARN. If you don't specify this value, then Secrets Manager defaults to using the AWS account's default KMS key (the one named `aws/secretsmanager`). If the default KMS key with that name doesn't yet exist, then AWS Secrets Manager creates it for you automatically the first time.[name](/content/registry/packages/aws/api-docs/secretsmanager/secret/#name_nodejs/index.html)Changes to this property will trigger replacement.stringFriendly name of the new secret. The secret name can consist of uppercase letters, lowercase letters, digits, and any of the following characters: `/_+=.@-` Conflicts with `namePrefix`.[namePrefix](/content/registry/packages/aws/api-docs/secretsmanager/secret/#nameprefix_nodejs/index.html)Changes to this property will trigger replacement.stringCreates a unique name beginning with the specified prefix. Conflicts with `name`.[policy](/content/registry/packages/aws/api-docs/secretsmanager/secret/#policy_nodejs/index.html)stringValid JSON document representing a [resource policy](https://docs.aws.amazon.com/secretsmanager/latest/userguide/auth-and-access_resource-based-policies.html). Removing `policy` from your configuration or setting `policy` to null or an empty string (i.e., `policy = ""`) _will not_ delete the policy since it could have been set by `aws.secretsmanager.SecretPolicy`. To delete the `policy`, set it to `"{}"` (an empty JSON document).[recoveryWindowInDays](/content/registry/packages/aws/api-docs/secretsmanager/secret/#recoverywindowindays_nodejs/index.html)numberNumber of days that AWS Secrets Manager waits before it can delete the secret. This value can be `0` to force deletion without recovery or range from `7` to `30` days. The default value is `30`.[region](/content/registry/packages/aws/api-docs/secretsmanager/secret/#region_nodejs/index.html)stringRegion where this resource will be [managed](https://docs.aws.amazon.com/general/latest/gr/rande.html#regional-endpoints). Defaults to the Region set in the provider configuration.[replicas](/content/registry/packages/aws/api-docs/secretsmanager/secret/#replicas_nodejs/index.html)[SecretReplica\[\]](/content/registry/packages/aws/api-docs/secretsmanager/secret/#secretreplica/index.html)Configuration block to support secret replication. See details below.[tags](/content/registry/packages/aws/api-docs/secretsmanager/secret/#tags_nodejs/index.html){\[key: string\]: string}Key-value map of user-defined tags that are attached to the secret. If configured with a provider `defaultTags` configuration block present, tags with matching keys will overwrite those defined at the provider-level. [description](/content/registry/packages/aws/api-docs/secretsmanager/secret/#description_python/index.html)strDescription of the secret.[force\_overwrite\_replica\_secret](/content/registry/packages/aws/api-docs/secretsmanager/secret/#force_overwrite_replica_secret_python/index.html)boolAccepts boolean value to specify whether to overwrite a secret with the same name in the destination Region.[kms\_key\_id](/content/registry/packages/aws/api-docs/secretsmanager/secret/#kms_key_id_python/index.html)strARN or Id of the AWS KMS key to be used to encrypt the secret values in the versions stored in this secret. If you need to reference a CMK in a different account, you can use only the key ARN. If you don't specify this value, then Secrets Manager defaults to using the AWS account's default KMS key (the one named `aws/secretsmanager`). If the default KMS key with that name doesn't yet exist, then AWS Secrets Manager creates it for you automatically the first time.[name](/content/registry/packages/aws/api-docs/secretsmanager/secret/#name_python/index.html)Changes to this property will trigger replacement.strFriendly name of the new secret. The secret name can consist of uppercase letters, lowercase letters, digits, and any of the following characters: `/_+=.@-` Conflicts with `namePrefix`.[name\_prefix](/content/registry/packages/aws/api-docs/secretsmanager/secret/#name_prefix_python/index.html)Changes to this property will trigger replacement.strCreates a unique name beginning with the specified prefix. Conflicts with `name`.[policy](/content/registry/packages/aws/api-docs/secretsmanager/secret/#policy_python/index.html)strValid JSON document representing a [resource policy](https://docs.aws.amazon.com/secretsmanager/latest/userguide/auth-and-access_resource-based-policies.html). Removing `policy` from your configuration or setting `policy` to null or an empty string (i.e., `policy = ""`) _will not_ delete the policy since it could have been set by `aws.secretsmanager.SecretPolicy`. To delete the `policy`, set it to `"{}"` (an empty JSON document).[recovery\_window\_in\_days](/content/registry/packages/aws/api-docs/secretsmanager/secret/#recovery_window_in_days_python/index.html)intNumber of days that AWS Secrets Manager waits before it can delete the secret. This value can be `0` to force deletion without recovery or range from `7` to `30` days. The default value is `30`.[region](/content/registry/packages/aws/api-docs/secretsmanager/secret/#region_python/index.html)strRegion where this resource will be [managed](https://docs.aws.amazon.com/general/latest/gr/rande.html#regional-endpoints). Defaults to the Region set in the provider configuration.[replicas](/content/registry/packages/aws/api-docs/secretsmanager/secret/#replicas_python/index.html)[Sequence\[SecretReplicaArgs\]](/content/registry/packages/aws/api-docs/secretsmanager/secret/#secretreplica/index.html)Configuration block to support secret replication. See details below.[tags](/content/registry/packages/aws/api-docs/secretsmanager/secret/#tags_python/index.html)Mapping\[str, str\]Key-value map of user-defined tags that are attached to the secret. If configured with a provider `defaultTags` configuration block present, tags with matching keys will overwrite those defined at the provider-level. [description](/content/registry/packages/aws/api-docs/secretsmanager/secret/#description_yaml/index.html)StringDescription of the secret.[forceOverwriteReplicaSecret](/content/registry/packages/aws/api-docs/secretsmanager/secret/#forceoverwritereplicasecret_yaml/index.html)BooleanAccepts boolean value to specify whether to overwrite a secret with the same name in the destination Region.[kmsKeyId](/content/registry/packages/aws/api-docs/secretsmanager/secret/#kmskeyid_yaml/index.html)StringARN or Id of the AWS KMS key to be used to encrypt the secret values in the versions stored in this secret. If you need to reference a CMK in a different account, you can use only the key ARN. If you don't specify this value, then Secrets Manager defaults to using the AWS account's default KMS key (the one named `aws/secretsmanager`). If the default KMS key with that name doesn't yet exist, then AWS Secrets Manager creates it for you automatically the first time.[name](/content/registry/packages/aws/api-docs/secretsmanager/secret/#name_yaml/index.html)Changes to this property will trigger replacement.StringFriendly name of the new secret. The secret name can consist of uppercase letters, lowercase letters, digits, and any of the following characters: `/_+=.@-` Conflicts with `namePrefix`.[namePrefix](/content/registry/packages/aws/api-docs/secretsmanager/secret/#nameprefix_yaml/index.html)Changes to this property will trigger replacement.StringCreates a unique name beginning with the specified prefix. Conflicts with `name`.[policy](/content/registry/packages/aws/api-docs/secretsmanager/secret/#policy_yaml/index.html)StringValid JSON document representing a [resource policy](https://docs.aws.amazon.com/secretsmanager/latest/userguide/auth-and-access_resource-based-policies.html). Removing `policy` from your configuration or setting `policy` to null or an empty string (i.e., `policy = ""`) _will not_ delete the policy since it could have been set by `aws.secretsmanager.SecretPolicy`. To delete the `policy`, set it to `"{}"` (an empty JSON document).[recoveryWindowInDays](/content/registry/packages/aws/api-docs/secretsmanager/secret/#recoverywindowindays_yaml/index.html)NumberNumber of days that AWS Secrets Manager waits before it can delete the secret. This value can be `0` to force deletion without recovery or range from `7` to `30` days. The default value is `30`.[region](/content/registry/packages/aws/api-docs/secretsmanager/secret/#region_yaml/index.html)StringRegion where this resource will be [managed](https://docs.aws.amazon.com/general/latest/gr/rande.html#regional-endpoints). Defaults to the Region set in the provider configuration.[replicas](/content/registry/packages/aws/api-docs/secretsmanager/secret/#replicas_yaml/index.html)[List](/content/registry/packages/aws/api-docs/secretsmanager/secret/#secretreplica/index.html)Configuration block to support secret replication. See details below.[tags](/content/registry/packages/aws/api-docs/secretsmanager/secret/#tags_yaml/index.html)MapKey-value map of user-defined tags that are attached to the secret. If configured with a provider `defaultTags` configuration block present, tags with matching keys will overwrite those defined at the provider-level. ### Outputs [Anchor](/content/registry/packages/aws/api-docs/secretsmanager/secret/\#outputs/index.html) All [input](/content/registry/packages/aws/api-docs/secretsmanager/secret/#inputs/index.html) properties are implicitly available as output properties. Additionally, the Secret resource produces the following output properties: [Arn](/content/registry/packages/aws/api-docs/secretsmanager/secret/#arn_csharp/index.html)stringARN of the secret.[Id](/content/registry/packages/aws/api-docs/secretsmanager/secret/#id_csharp/index.html)stringThe provider-assigned unique ID for this managed resource.[TagsAll](/content/registry/packages/aws/api-docs/secretsmanager/secret/#tagsall_csharp/index.html)DictionaryMap of tags assigned to the resource, including those inherited from the provider `defaultTags` configuration block. [Arn](/content/registry/packages/aws/api-docs/secretsmanager/secret/#arn_go/index.html)stringARN of the secret.[Id](/content/registry/packages/aws/api-docs/secretsmanager/secret/#id_go/index.html)stringThe provider-assigned unique ID for this managed resource.[TagsAll](/content/registry/packages/aws/api-docs/secretsmanager/secret/#tagsall_go/index.html)map\[string\]stringMap of tags assigned to the resource, including those inherited from the provider `defaultTags` configuration block. [arn](/content/registry/packages/aws/api-docs/secretsmanager/secret/#arn_hcl/index.html)stringARN of the secret.[id](/content/registry/packages/aws/api-docs/secretsmanager/secret/#id_hcl/index.html)stringThe provider-assigned unique ID for this managed resource.[tags\_all](/content/registry/packages/aws/api-docs/secretsmanager/secret/#tags_all_hcl/index.html)map(string)Map of tags assigned to the resource, including those inherited from the provider `defaultTags` configuration block. [arn](/content/registry/packages/aws/api-docs/secretsmanager/secret/#arn_java/index.html)StringARN of the secret.[id](/content/registry/packages/aws/api-docs/secretsmanager/secret/#id_java/index.html)StringThe provider-assigned unique ID for this managed resource.[tagsAll](/content/registry/packages/aws/api-docs/secretsmanager/secret/#tagsall_java/index.html)MapMap of tags assigned to the resource, including those inherited from the provider `defaultTags` configuration block. [arn](/content/registry/packages/aws/api-docs/secretsmanager/secret/#arn_nodejs/index.html)stringARN of the secret.[id](/content/registry/packages/aws/api-docs/secretsmanager/secret/#id_nodejs/index.html)stringThe provider-assigned unique ID for this managed resource.[tagsAll](/content/registry/packages/aws/api-docs/secretsmanager/secret/#tagsall_nodejs/index.html){\[key: string\]: string}Map of tags assigned to the resource, including those inherited from the provider `defaultTags` configuration block. [arn](/content/registry/packages/aws/api-docs/secretsmanager/secret/#arn_python/index.html)strARN of the secret.[id](/content/registry/packages/aws/api-docs/secretsmanager/secret/#id_python/index.html)strThe provider-assigned unique ID for this managed resource.[tags\_all](/content/registry/packages/aws/api-docs/secretsmanager/secret/#tags_all_python/index.html)Mapping\[str, str\]Map of tags assigned to the resource, including those inherited from the provider `defaultTags` configuration block. [arn](/content/registry/packages/aws/api-docs/secretsmanager/secret/#arn_yaml/index.html)StringARN of the secret.[id](/content/registry/packages/aws/api-docs/secretsmanager/secret/#id_yaml/index.html)StringThe provider-assigned unique ID for this managed resource.[tagsAll](/content/registry/packages/aws/api-docs/secretsmanager/secret/#tagsall_yaml/index.html)MapMap of tags assigned to the resource, including those inherited from the provider `defaultTags` configuration block. ## Look up Existing Secret Resource [Anchor](/content/registry/packages/aws/api-docs/secretsmanager/secret/\#look-up/index.html) Get an existing Secret resource’s state with the given name, ID, and optional extra properties used to qualify the lookup. - TypeScript - Python - Go - C# - Java - YAML - HCL PREVIEW ```typescript public static get(name: string, id: Input, state?: SecretState, opts?: CustomResourceOptions): Secret ``` ```python @staticmethod def get(resource_name: str, id: str, opts: Optional[ResourceOptions] = None, arn: Optional[str] = None, description: Optional[str] = None, force_overwrite_replica_secret: Optional[bool] = None, kms_key_id: Optional[str] = None, name: Optional[str] = None, name_prefix: Optional[str] = None, policy: Optional[str] = None, recovery_window_in_days: Optional[int] = None, region: Optional[str] = None, replicas: Optional[Sequence[SecretReplicaArgs]] = None, tags: Optional[Mapping[str, str]] = None, tags_all: Optional[Mapping[str, str]] = None) -> Secret ``` ```go func GetSecret(ctx *Context, name string, id IDInput, state *SecretState, opts ...ResourceOption) (*Secret, error) ``` ```csharp public static Secret Get(string name, Input id, SecretState? state, CustomResourceOptions? opts = null) ``` ```java public static Secret get(String name, Output id, SecretState state, CustomResourceOptions options) ``` ```yaml resources: _: type: aws:secretsmanager:Secret get: id: ${id} ``` ```hcl import { to = aws_secretsmanager_secret.example id = "${id}" } ``` nameThis property is required.The unique name of the resulting resource.idThis property is required.The _unique_ provider ID of the resource to lookup.stateAny extra arguments used during the lookup.optsA bag of options that control this resource's behavior. resource\_nameThis property is required.The unique name of the resulting resource.idThis property is required.The _unique_ provider ID of the resource to lookup. The following state arguments are supported: [Arn](/content/registry/packages/aws/api-docs/secretsmanager/secret/#state_arn_csharp/index.html)stringARN of the secret.[Description](/content/registry/packages/aws/api-docs/secretsmanager/secret/#state_description_csharp/index.html)stringDescription of the secret.[ForceOverwriteReplicaSecret](/content/registry/packages/aws/api-docs/secretsmanager/secret/#state_forceoverwritereplicasecret_csharp/index.html)boolAccepts boolean value to specify whether to overwrite a secret with the same name in the destination Region.[KmsKeyId](/content/registry/packages/aws/api-docs/secretsmanager/secret/#state_kmskeyid_csharp/index.html)stringARN or Id of the AWS KMS key to be used to encrypt the secret values in the versions stored in this secret. If you need to reference a CMK in a different account, you can use only the key ARN. If you don't specify this value, then Secrets Manager defaults to using the AWS account's default KMS key (the one named `aws/secretsmanager`). If the default KMS key with that name doesn't yet exist, then AWS Secrets Manager creates it for you automatically the first time.[Name](/content/registry/packages/aws/api-docs/secretsmanager/secret/#state_name_csharp/index.html)Changes to this property will trigger replacement.stringFriendly name of the new secret. The secret name can consist of uppercase letters, lowercase letters, digits, and any of the following characters: `/_+=.@-` Conflicts with `namePrefix`.[NamePrefix](/content/registry/packages/aws/api-docs/secretsmanager/secret/#state_nameprefix_csharp/index.html)Changes to this property will trigger replacement.stringCreates a unique name beginning with the specified prefix. Conflicts with `name`.[Policy](/content/registry/packages/aws/api-docs/secretsmanager/secret/#state_policy_csharp/index.html)stringValid JSON document representing a [resource policy](https://docs.aws.amazon.com/secretsmanager/latest/userguide/auth-and-access_resource-based-policies.html). Removing `policy` from your configuration or setting `policy` to null or an empty string (i.e., `policy = ""`) _will not_ delete the policy since it could have been set by `aws.secretsmanager.SecretPolicy`. To delete the `policy`, set it to `"{}"` (an empty JSON document).[RecoveryWindowInDays](/content/registry/packages/aws/api-docs/secretsmanager/secret/#state_recoverywindowindays_csharp/index.html)intNumber of days that AWS Secrets Manager waits before it can delete the secret. This value can be `0` to force deletion without recovery or range from `7` to `30` days. The default value is `30`.[Region](/content/registry/packages/aws/api-docs/secretsmanager/secret/#state_region_csharp/index.html)stringRegion where this resource will be [managed](https://docs.aws.amazon.com/general/latest/gr/rande.html#regional-endpoints). Defaults to the Region set in the provider configuration.[Replicas](/content/registry/packages/aws/api-docs/secretsmanager/secret/#state_replicas_csharp/index.html)[List](/content/registry/packages/aws/api-docs/secretsmanager/secret/#secretreplica/index.html)Configuration block to support secret replication. See details below.[Tags](/content/registry/packages/aws/api-docs/secretsmanager/secret/#state_tags_csharp/index.html)DictionaryKey-value map of user-defined tags that are attached to the secret. If configured with a provider `defaultTags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.[TagsAll](/content/registry/packages/aws/api-docs/secretsmanager/secret/#state_tagsall_csharp/index.html)DictionaryMap of tags assigned to the resource, including those inherited from the provider `defaultTags` configuration block. [Arn](/content/registry/packages/aws/api-docs/secretsmanager/secret/#state_arn_go/index.html)stringARN of the secret.[Description](/content/registry/packages/aws/api-docs/secretsmanager/secret/#state_description_go/index.html)stringDescription of the secret.[ForceOverwriteReplicaSecret](/content/registry/packages/aws/api-docs/secretsmanager/secret/#state_forceoverwritereplicasecret_go/index.html)boolAccepts boolean value to specify whether to overwrite a secret with the same name in the destination Region.[KmsKeyId](/content/registry/packages/aws/api-docs/secretsmanager/secret/#state_kmskeyid_go/index.html)stringARN or Id of the AWS KMS key to be used to encrypt the secret values in the versions stored in this secret. If you need to reference a CMK in a different account, you can use only the key ARN. If you don't specify this value, then Secrets Manager defaults to using the AWS account's default KMS key (the one named `aws/secretsmanager`). If the default KMS key with that name doesn't yet exist, then AWS Secrets Manager creates it for you automatically the first time.[Name](/content/registry/packages/aws/api-docs/secretsmanager/secret/#state_name_go/index.html)Changes to this property will trigger replacement.stringFriendly name of the new secret. The secret name can consist of uppercase letters, lowercase letters, digits, and any of the following characters: `/_+=.@-` Conflicts with `namePrefix`.[NamePrefix](/content/registry/packages/aws/api-docs/secretsmanager/secret/#state_nameprefix_go/index.html)Changes to this property will trigger replacement.stringCreates a unique name beginning with the specified prefix. Conflicts with `name`.[Policy](/content/registry/packages/aws/api-docs/secretsmanager/secret/#state_policy_go/index.html)stringValid JSON document representing a [resource policy](https://docs.aws.amazon.com/secretsmanager/latest/userguide/auth-and-access_resource-based-policies.html). Removing `policy` from your configuration or setting `policy` to null or an empty string (i.e., `policy = ""`) _will not_ delete the policy since it could have been set by `aws.secretsmanager.SecretPolicy`. To delete the `policy`, set it to `"{}"` (an empty JSON document).[RecoveryWindowInDays](/content/registry/packages/aws/api-docs/secretsmanager/secret/#state_recoverywindowindays_go/index.html)intNumber of days that AWS Secrets Manager waits before it can delete the secret. This value can be `0` to force deletion without recovery or range from `7` to `30` days. The default value is `30`.[Region](/content/registry/packages/aws/api-docs/secretsmanager/secret/#state_region_go/index.html)stringRegion where this resource will be [managed](https://docs.aws.amazon.com/general/latest/gr/rande.html#regional-endpoints). Defaults to the Region set in the provider configuration.[Replicas](/content/registry/packages/aws/api-docs/secretsmanager/secret/#state_replicas_go/index.html)[\[\]SecretReplicaArgs](/content/registry/packages/aws/api-docs/secretsmanager/secret/#secretreplica/index.html)Configuration block to support secret replication. See details below.[Tags](/content/registry/packages/aws/api-docs/secretsmanager/secret/#state_tags_go/index.html)map\[string\]stringKey-value map of user-defined tags that are attached to the secret. If configured with a provider `defaultTags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.[TagsAll](/content/registry/packages/aws/api-docs/secretsmanager/secret/#state_tagsall_go/index.html)map\[string\]stringMap of tags assigned to the resource, including those inherited from the provider `defaultTags` configuration block. [arn](/content/registry/packages/aws/api-docs/secretsmanager/secret/#state_arn_hcl/index.html)stringARN of the secret.[description](/content/registry/packages/aws/api-docs/secretsmanager/secret/#state_description_hcl/index.html)stringDescription of the secret.[force\_overwrite\_replica\_secret](/content/registry/packages/aws/api-docs/secretsmanager/secret/#state_force_overwrite_replica_secret_hcl/index.html)boolAccepts boolean value to specify whether to overwrite a secret with the same name in the destination Region.[kms\_key\_id](/content/registry/packages/aws/api-docs/secretsmanager/secret/#state_kms_key_id_hcl/index.html)stringARN or Id of the AWS KMS key to be used to encrypt the secret values in the versions stored in this secret. If you need to reference a CMK in a different account, you can use only the key ARN. If you don't specify this value, then Secrets Manager defaults to using the AWS account's default KMS key (the one named `aws/secretsmanager`). If the default KMS key with that name doesn't yet exist, then AWS Secrets Manager creates it for you automatically the first time.[name](/content/registry/packages/aws/api-docs/secretsmanager/secret/#state_name_hcl/index.html)Changes to this property will trigger replacement.stringFriendly name of the new secret. The secret name can consist of uppercase letters, lowercase letters, digits, and any of the following characters: `/_+=.@-` Conflicts with `namePrefix`.[name\_prefix](/content/registry/packages/aws/api-docs/secretsmanager/secret/#state_name_prefix_hcl/index.html)Changes to this property will trigger replacement.stringCreates a unique name beginning with the specified prefix. Conflicts with `name`.[policy](/content/registry/packages/aws/api-docs/secretsmanager/secret/#state_policy_hcl/index.html)stringValid JSON document representing a [resource policy](https://docs.aws.amazon.com/secretsmanager/latest/userguide/auth-and-access_resource-based-policies.html). Removing `policy` from your configuration or setting `policy` to null or an empty string (i.e., `policy = ""`) _will not_ delete the policy since it could have been set by `aws.secretsmanager.SecretPolicy`. To delete the `policy`, set it to `"{}"` (an empty JSON document).[recovery\_window\_in\_days](/content/registry/packages/aws/api-docs/secretsmanager/secret/#state_recovery_window_in_days_hcl/index.html)numberNumber of days that AWS Secrets Manager waits before it can delete the secret. This value can be `0` to force deletion without recovery or range from `7` to `30` days. The default value is `30`.[region](/content/registry/packages/aws/api-docs/secretsmanager/secret/#state_region_hcl/index.html)stringRegion where this resource will be [managed](https://docs.aws.amazon.com/general/latest/gr/rande.html#regional-endpoints). Defaults to the Region set in the provider configuration.[replicas](/content/registry/packages/aws/api-docs/secretsmanager/secret/#state_replicas_hcl/index.html)[list(object)](/content/registry/packages/aws/api-docs/secretsmanager/secret/#secretreplica/index.html)Configuration block to support secret replication. See details below.[tags](/content/registry/packages/aws/api-docs/secretsmanager/secret/#state_tags_hcl/index.html)map(string)Key-value map of user-defined tags that are attached to the secret. If configured with a provider `defaultTags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.[tags\_all](/content/registry/packages/aws/api-docs/secretsmanager/secret/#state_tags_all_hcl/index.html)map(string)Map of tags assigned to the resource, including those inherited from the provider `defaultTags` configuration block. [arn](/content/registry/packages/aws/api-docs/secretsmanager/secret/#state_arn_java/index.html)StringARN of the secret.[description](/content/registry/packages/aws/api-docs/secretsmanager/secret/#state_description_java/index.html)StringDescription of the secret.[forceOverwriteReplicaSecret](/content/registry/packages/aws/api-docs/secretsmanager/secret/#state_forceoverwritereplicasecret_java/index.html)BooleanAccepts boolean value to specify whether to overwrite a secret with the same name in the destination Region.[kmsKeyId](/content/registry/packages/aws/api-docs/secretsmanager/secret/#state_kmskeyid_java/index.html)StringARN or Id of the AWS KMS key to be used to encrypt the secret values in the versions stored in this secret. If you need to reference a CMK in a different account, you can use only the key ARN. If you don't specify this value, then Secrets Manager defaults to using the AWS account's default KMS key (the one named `aws/secretsmanager`). If the default KMS key with that name doesn't yet exist, then AWS Secrets Manager creates it for you automatically the first time.[name](/content/registry/packages/aws/api-docs/secretsmanager/secret/#state_name_java/index.html)Changes to this property will trigger replacement.StringFriendly name of the new secret. The secret name can consist of uppercase letters, lowercase letters, digits, and any of the following characters: `/_+=.@-` Conflicts with `namePrefix`.[namePrefix](/content/registry/packages/aws/api-docs/secretsmanager/secret/#state_nameprefix_java/index.html)Changes to this property will trigger replacement.StringCreates a unique name beginning with the specified prefix. Conflicts with `name`.[policy](/content/registry/packages/aws/api-docs/secretsmanager/secret/#state_policy_java/index.html)StringValid JSON document representing a [resource policy](https://docs.aws.amazon.com/secretsmanager/latest/userguide/auth-and-access_resource-based-policies.html). Removing `policy` from your configuration or setting `policy` to null or an empty string (i.e., `policy = ""`) _will not_ delete the policy since it could have been set by `aws.secretsmanager.SecretPolicy`. To delete the `policy`, set it to `"{}"` (an empty JSON document).[recoveryWindowInDays](/content/registry/packages/aws/api-docs/secretsmanager/secret/#state_recoverywindowindays_java/index.html)IntegerNumber of days that AWS Secrets Manager waits before it can delete the secret. This value can be `0` to force deletion without recovery or range from `7` to `30` days. The default value is `30`.[region](/content/registry/packages/aws/api-docs/secretsmanager/secret/#state_region_java/index.html)StringRegion where this resource will be [managed](https://docs.aws.amazon.com/general/latest/gr/rande.html#regional-endpoints). Defaults to the Region set in the provider configuration.[replicas](/content/registry/packages/aws/api-docs/secretsmanager/secret/#state_replicas_java/index.html)[List](/content/registry/packages/aws/api-docs/secretsmanager/secret/#secretreplica/index.html)Configuration block to support secret replication. See details below.[tags](/content/registry/packages/aws/api-docs/secretsmanager/secret/#state_tags_java/index.html)MapKey-value map of user-defined tags that are attached to the secret. If configured with a provider `defaultTags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.[tagsAll](/content/registry/packages/aws/api-docs/secretsmanager/secret/#state_tagsall_java/index.html)MapMap of tags assigned to the resource, including those inherited from the provider `defaultTags` configuration block. [arn](/content/registry/packages/aws/api-docs/secretsmanager/secret/#state_arn_nodejs/index.html)stringARN of the secret.[description](/content/registry/packages/aws/api-docs/secretsmanager/secret/#state_description_nodejs/index.html)stringDescription of the secret.[forceOverwriteReplicaSecret](/content/registry/packages/aws/api-docs/secretsmanager/secret/#state_forceoverwritereplicasecret_nodejs/index.html)booleanAccepts boolean value to specify whether to overwrite a secret with the same name in the destination Region.[kmsKeyId](/content/registry/packages/aws/api-docs/secretsmanager/secret/#state_kmskeyid_nodejs/index.html)stringARN or Id of the AWS KMS key to be used to encrypt the secret values in the versions stored in this secret. If you need to reference a CMK in a different account, you can use only the key ARN. If you don't specify this value, then Secrets Manager defaults to using the AWS account's default KMS key (the one named `aws/secretsmanager`). If the default KMS key with that name doesn't yet exist, then AWS Secrets Manager creates it for you automatically the first time.[name](/content/registry/packages/aws/api-docs/secretsmanager/secret/#state_name_nodejs/index.html)Changes to this property will trigger replacement.stringFriendly name of the new secret. The secret name can consist of uppercase letters, lowercase letters, digits, and any of the following characters: `/_+=.@-` Conflicts with `namePrefix`.[namePrefix](/content/registry/packages/aws/api-docs/secretsmanager/secret/#state_nameprefix_nodejs/index.html)Changes to this property will trigger replacement.stringCreates a unique name beginning with the specified prefix. Conflicts with `name`.[policy](/content/registry/packages/aws/api-docs/secretsmanager/secret/#state_policy_nodejs/index.html)stringValid JSON document representing a [resource policy](https://docs.aws.amazon.com/secretsmanager/latest/userguide/auth-and-access_resource-based-policies.html). Removing `policy` from your configuration or setting `policy` to null or an empty string (i.e., `policy = ""`) _will not_ delete the policy since it could have been set by `aws.secretsmanager.SecretPolicy`. To delete the `policy`, set it to `"{}"` (an empty JSON document).[recoveryWindowInDays](/content/registry/packages/aws/api-docs/secretsmanager/secret/#state_recoverywindowindays_nodejs/index.html)numberNumber of days that AWS Secrets Manager waits before it can delete the secret. This value can be `0` to force deletion without recovery or range from `7` to `30` days. The default value is `30`.[region](/content/registry/packages/aws/api-docs/secretsmanager/secret/#state_region_nodejs/index.html)stringRegion where this resource will be [managed](https://docs.aws.amazon.com/general/latest/gr/rande.html#regional-endpoints). Defaults to the Region set in the provider configuration.[replicas](/content/registry/packages/aws/api-docs/secretsmanager/secret/#state_replicas_nodejs/index.html)[SecretReplica\[\]](/content/registry/packages/aws/api-docs/secretsmanager/secret/#secretreplica/index.html)Configuration block to support secret replication. See details below.[tags](/content/registry/packages/aws/api-docs/secretsmanager/secret/#state_tags_nodejs/index.html){\[key: string\]: string}Key-value map of user-defined tags that are attached to the secret. If configured with a provider `defaultTags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.[tagsAll](/content/registry/packages/aws/api-docs/secretsmanager/secret/#state_tagsall_nodejs/index.html){\[key: string\]: string}Map of tags assigned to the resource, including those inherited from the provider `defaultTags` configuration block. [arn](/content/registry/packages/aws/api-docs/secretsmanager/secret/#state_arn_python/index.html)strARN of the secret.[description](/content/registry/packages/aws/api-docs/secretsmanager/secret/#state_description_python/index.html)strDescription of the secret.[force\_overwrite\_replica\_secret](/content/registry/packages/aws/api-docs/secretsmanager/secret/#state_force_overwrite_replica_secret_python/index.html)boolAccepts boolean value to specify whether to overwrite a secret with the same name in the destination Region.[kms\_key\_id](/content/registry/packages/aws/api-docs/secretsmanager/secret/#state_kms_key_id_python/index.html)strARN or Id of the AWS KMS key to be used to encrypt the secret values in the versions stored in this secret. If you need to reference a CMK in a different account, you can use only the key ARN. If you don't specify this value, then Secrets Manager defaults to using the AWS account's default KMS key (the one named `aws/secretsmanager`). If the default KMS key with that name doesn't yet exist, then AWS Secrets Manager creates it for you automatically the first time.[name](/content/registry/packages/aws/api-docs/secretsmanager/secret/#state_name_python/index.html)Changes to this property will trigger replacement.strFriendly name of the new secret. The secret name can consist of uppercase letters, lowercase letters, digits, and any of the following characters: `/_+=.@-` Conflicts with `namePrefix`.[name\_prefix](/content/registry/packages/aws/api-docs/secretsmanager/secret/#state_name_prefix_python/index.html)Changes to this property will trigger replacement.strCreates a unique name beginning with the specified prefix. Conflicts with `name`.[policy](/content/registry/packages/aws/api-docs/secretsmanager/secret/#state_policy_python/index.html)strValid JSON document representing a [resource policy](https://docs.aws.amazon.com/secretsmanager/latest/userguide/auth-and-access_resource-based-policies.html). Removing `policy` from your configuration or setting `policy` to null or an empty string (i.e., `policy = ""`) _will not_ delete the policy since it could have been set by `aws.secretsmanager.SecretPolicy`. To delete the `policy`, set it to `"{}"` (an empty JSON document).[recovery\_window\_in\_days](/content/registry/packages/aws/api-docs/secretsmanager/secret/#state_recovery_window_in_days_python/index.html)intNumber of days that AWS Secrets Manager waits before it can delete the secret. This value can be `0` to force deletion without recovery or range from `7` to `30` days. The default value is `30`.[region](/content/registry/packages/aws/api-docs/secretsmanager/secret/#state_region_python/index.html)strRegion where this resource will be [managed](https://docs.aws.amazon.com/general/latest/gr/rande.html#regional-endpoints). Defaults to the Region set in the provider configuration.[replicas](/content/registry/packages/aws/api-docs/secretsmanager/secret/#state_replicas_python/index.html)[Sequence\[SecretReplicaArgs\]](/content/registry/packages/aws/api-docs/secretsmanager/secret/#secretreplica/index.html)Configuration block to support secret replication. See details below.[tags](/content/registry/packages/aws/api-docs/secretsmanager/secret/#state_tags_python/index.html)Mapping\[str, str\]Key-value map of user-defined tags that are attached to the secret. If configured with a provider `defaultTags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.[tags\_all](/content/registry/packages/aws/api-docs/secretsmanager/secret/#state_tags_all_python/index.html)Mapping\[str, str\]Map of tags assigned to the resource, including those inherited from the provider `defaultTags` configuration block. [arn](/content/registry/packages/aws/api-docs/secretsmanager/secret/#state_arn_yaml/index.html)StringARN of the secret.[description](/content/registry/packages/aws/api-docs/secretsmanager/secret/#state_description_yaml/index.html)StringDescription of the secret.[forceOverwriteReplicaSecret](/content/registry/packages/aws/api-docs/secretsmanager/secret/#state_forceoverwritereplicasecret_yaml/index.html)BooleanAccepts boolean value to specify whether to overwrite a secret with the same name in the destination Region.[kmsKeyId](/content/registry/packages/aws/api-docs/secretsmanager/secret/#state_kmskeyid_yaml/index.html)StringARN or Id of the AWS KMS key to be used to encrypt the secret values in the versions stored in this secret. If you need to reference a CMK in a different account, you can use only the key ARN. If you don't specify this value, then Secrets Manager defaults to using the AWS account's default KMS key (the one named `aws/secretsmanager`). If the default KMS key with that name doesn't yet exist, then AWS Secrets Manager creates it for you automatically the first time.[name](/content/registry/packages/aws/api-docs/secretsmanager/secret/#state_name_yaml/index.html)Changes to this property will trigger replacement.StringFriendly name of the new secret. The secret name can consist of uppercase letters, lowercase letters, digits, and any of the following characters: `/_+=.@-` Conflicts with `namePrefix`.[namePrefix](/content/registry/packages/aws/api-docs/secretsmanager/secret/#state_nameprefix_yaml/index.html)Changes to this property will trigger replacement.StringCreates a unique name beginning with the specified prefix. Conflicts with `name`.[policy](/content/registry/packages/aws/api-docs/secretsmanager/secret/#state_policy_yaml/index.html)StringValid JSON document representing a [resource policy](https://docs.aws.amazon.com/secretsmanager/latest/userguide/auth-and-access_resource-based-policies.html). Removing `policy` from your configuration or setting `policy` to null or an empty string (i.e., `policy = ""`) _will not_ delete the policy since it could have been set by `aws.secretsmanager.SecretPolicy`. To delete the `policy`, set it to `"{}"` (an empty JSON document).[recoveryWindowInDays](/content/registry/packages/aws/api-docs/secretsmanager/secret/#state_recoverywindowindays_yaml/index.html)NumberNumber of days that AWS Secrets Manager waits before it can delete the secret. This value can be `0` to force deletion without recovery or range from `7` to `30` days. The default value is `30`.[region](/content/registry/packages/aws/api-docs/secretsmanager/secret/#state_region_yaml/index.html)StringRegion where this resource will be [managed](https://docs.aws.amazon.com/general/latest/gr/rande.html#regional-endpoints). Defaults to the Region set in the provider configuration.[replicas](/content/registry/packages/aws/api-docs/secretsmanager/secret/#state_replicas_yaml/index.html)[List](/content/registry/packages/aws/api-docs/secretsmanager/secret/#secretreplica/index.html)Configuration block to support secret replication. See details below.[tags](/content/registry/packages/aws/api-docs/secretsmanager/secret/#state_tags_yaml/index.html)MapKey-value map of user-defined tags that are attached to the secret. If configured with a provider `defaultTags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.[tagsAll](/content/registry/packages/aws/api-docs/secretsmanager/secret/#state_tagsall_yaml/index.html)MapMap of tags assigned to the resource, including those inherited from the provider `defaultTags` configuration block. ## Supporting Types [Anchor](/content/registry/packages/aws/api-docs/secretsmanager/secret/\#supporting-types/index.html) #### SecretReplica , SecretReplicaArgs [Anchor](/content/registry/packages/aws/api-docs/secretsmanager/secret/\#secretreplica/index.html) [Region](/content/registry/packages/aws/api-docs/secretsmanager/secret/#region_csharp/index.html)This property is required.stringRegion for replicating the secret.[KmsKeyId](/content/registry/packages/aws/api-docs/secretsmanager/secret/#kmskeyid_csharp/index.html)stringARN, Key ID, or Alias of the AWS KMS key within the region secret is replicated to. If one is not specified, then Secrets Manager defaults to using the AWS account's default KMS key (`aws/secretsmanager`) in the region or creates one for use if non-existent.[LastAccessedDate](/content/registry/packages/aws/api-docs/secretsmanager/secret/#lastaccesseddate_csharp/index.html)stringDate that you last accessed the secret in the Region.[Status](/content/registry/packages/aws/api-docs/secretsmanager/secret/#status_csharp/index.html)stringStatus can be `InProgress`, `Failed`, or `InSync`.[StatusMessage](/content/registry/packages/aws/api-docs/secretsmanager/secret/#statusmessage_csharp/index.html)stringMessage such as `Replication succeeded` or `Secret with this name already exists in this region`. [Region](/content/registry/packages/aws/api-docs/secretsmanager/secret/#region_go/index.html)This property is required.stringRegion for replicating the secret.[KmsKeyId](/content/registry/packages/aws/api-docs/secretsmanager/secret/#kmskeyid_go/index.html)stringARN, Key ID, or Alias of the AWS KMS key within the region secret is replicated to. If one is not specified, then Secrets Manager defaults to using the AWS account's default KMS key (`aws/secretsmanager`) in the region or creates one for use if non-existent.[LastAccessedDate](/content/registry/packages/aws/api-docs/secretsmanager/secret/#lastaccesseddate_go/index.html)stringDate that you last accessed the secret in the Region.[Status](/content/registry/packages/aws/api-docs/secretsmanager/secret/#status_go/index.html)stringStatus can be `InProgress`, `Failed`, or `InSync`.[StatusMessage](/content/registry/packages/aws/api-docs/secretsmanager/secret/#statusmessage_go/index.html)stringMessage such as `Replication succeeded` or `Secret with this name already exists in this region`. [region](/content/registry/packages/aws/api-docs/secretsmanager/secret/#region_hcl/index.html)This property is required.stringRegion for replicating the secret.[kms\_key\_id](/content/registry/packages/aws/api-docs/secretsmanager/secret/#kms_key_id_hcl/index.html)stringARN, Key ID, or Alias of the AWS KMS key within the region secret is replicated to. If one is not specified, then Secrets Manager defaults to using the AWS account's default KMS key (`aws/secretsmanager`) in the region or creates one for use if non-existent.[last\_accessed\_date](/content/registry/packages/aws/api-docs/secretsmanager/secret/#last_accessed_date_hcl/index.html)stringDate that you last accessed the secret in the Region.[status](/content/registry/packages/aws/api-docs/secretsmanager/secret/#status_hcl/index.html)stringStatus can be `InProgress`, `Failed`, or `InSync`.[status\_message](/content/registry/packages/aws/api-docs/secretsmanager/secret/#status_message_hcl/index.html)stringMessage such as `Replication succeeded` or `Secret with this name already exists in this region`. [region](/content/registry/packages/aws/api-docs/secretsmanager/secret/#region_java/index.html)This property is required.StringRegion for replicating the secret.[kmsKeyId](/content/registry/packages/aws/api-docs/secretsmanager/secret/#kmskeyid_java/index.html)StringARN, Key ID, or Alias of the AWS KMS key within the region secret is replicated to. If one is not specified, then Secrets Manager defaults to using the AWS account's default KMS key (`aws/secretsmanager`) in the region or creates one for use if non-existent.[lastAccessedDate](/content/registry/packages/aws/api-docs/secretsmanager/secret/#lastaccesseddate_java/index.html)StringDate that you last accessed the secret in the Region.[status](/content/registry/packages/aws/api-docs/secretsmanager/secret/#status_java/index.html)StringStatus can be `InProgress`, `Failed`, or `InSync`.[statusMessage](/content/registry/packages/aws/api-docs/secretsmanager/secret/#statusmessage_java/index.html)StringMessage such as `Replication succeeded` or `Secret with this name already exists in this region`. [region](/content/registry/packages/aws/api-docs/secretsmanager/secret/#region_nodejs/index.html)This property is required.stringRegion for replicating the secret.[kmsKeyId](/content/registry/packages/aws/api-docs/secretsmanager/secret/#kmskeyid_nodejs/index.html)stringARN, Key ID, or Alias of the AWS KMS key within the region secret is replicated to. If one is not specified, then Secrets Manager defaults to using the AWS account's default KMS key (`aws/secretsmanager`) in the region or creates one for use if non-existent.[lastAccessedDate](/content/registry/packages/aws/api-docs/secretsmanager/secret/#lastaccesseddate_nodejs/index.html)stringDate that you last accessed the secret in the Region.[status](/content/registry/packages/aws/api-docs/secretsmanager/secret/#status_nodejs/index.html)stringStatus can be `InProgress`, `Failed`, or `InSync`.[statusMessage](/content/registry/packages/aws/api-docs/secretsmanager/secret/#statusmessage_nodejs/index.html)stringMessage such as `Replication succeeded` or `Secret with this name already exists in this region`. [region](/content/registry/packages/aws/api-docs/secretsmanager/secret/#region_python/index.html)This property is required.strRegion for replicating the secret.[kms\_key\_id](/content/registry/packages/aws/api-docs/secretsmanager/secret/#kms_key_id_python/index.html)strARN, Key ID, or Alias of the AWS KMS key within the region secret is replicated to. If one is not specified, then Secrets Manager defaults to using the AWS account's default KMS key (`aws/secretsmanager`) in the region or creates one for use if non-existent.[last\_accessed\_date](/content/registry/packages/aws/api-docs/secretsmanager/secret/#last_accessed_date_python/index.html)strDate that you last accessed the secret in the Region.[status](/content/registry/packages/aws/api-docs/secretsmanager/secret/#status_python/index.html)strStatus can be `InProgress`, `Failed`, or `InSync`.[status\_message](/content/registry/packages/aws/api-docs/secretsmanager/secret/#status_message_python/index.html)strMessage such as `Replication succeeded` or `Secret with this name already exists in this region`. [region](/content/registry/packages/aws/api-docs/secretsmanager/secret/#region_yaml/index.html)This property is required.StringRegion for replicating the secret.[kmsKeyId](/content/registry/packages/aws/api-docs/secretsmanager/secret/#kmskeyid_yaml/index.html)StringARN, Key ID, or Alias of the AWS KMS key within the region secret is replicated to. If one is not specified, then Secrets Manager defaults to using the AWS account's default KMS key (`aws/secretsmanager`) in the region or creates one for use if non-existent.[lastAccessedDate](/content/registry/packages/aws/api-docs/secretsmanager/secret/#lastaccesseddate_yaml/index.html)StringDate that you last accessed the secret in the Region.[status](/content/registry/packages/aws/api-docs/secretsmanager/secret/#status_yaml/index.html)StringStatus can be `InProgress`, `Failed`, or `InSync`.[statusMessage](/content/registry/packages/aws/api-docs/secretsmanager/secret/#statusmessage_yaml/index.html)StringMessage such as `Replication succeeded` or `Secret with this name already exists in this region`. ## Import [Anchor](/content/registry/packages/aws/api-docs/secretsmanager/secret/\#import/index.html) ### Identity Schema [Anchor](/content/registry/packages/aws/api-docs/secretsmanager/secret/\#identity-schema/index.html) #### Required [Anchor](/content/registry/packages/aws/api-docs/secretsmanager/secret/\#required/index.html) - `arn` (String) Amazon Resource Name (ARN) of the Secrets Manager secret. Using `pulumi import`, import `aws.secretsmanager.Secret` using the secret Amazon Resource Name (ARN). For example: ```sh $ pulumi import aws:secretsmanager/secret:Secret example arn:aws:secretsmanager:us-east-1:123456789012:secret:example-123456 ``` Copy To learn more about importing existing cloud resources, see [Importing resources](/content/docs/using-pulumi/adopting-pulumi/import/index.html). ## Package Details [Anchor](/content/registry/packages/aws/api-docs/secretsmanager/secret/\#package-details/index.html) Viewing docs for AWS v7.32.0 published on Friday, May 29, 2026 by Pulumi [Schema (JSON)](/content/registry/packages/aws/schema.json) [pulumi/pulumi-aws](https://github.com/pulumi/pulumi-aws) v7.32.0 (7.x, latest)v6.83.1 (6.x)v5.43.0 (5.x) ## On this page ## On this page * * * Related Resources [secretsmanager.SecretVersion](/content/registry/packages/aws/api-docs/secretsmanager/secretversion/index.html) [ecs.TaskDefinition](/content/registry/packages/aws/api-docs/ecs/taskdefinition/index.html) [lambda.Function](/content/registry/packages/aws/api-docs/lambda/function/index.html) [iam.Policy](/content/registry/packages/aws/api-docs/iam/policy/index.html) [iam.RolePolicy](/content/registry/packages/aws/api-docs/iam/rolepolicy/index.html) [rds.Proxy](/content/registry/packages/aws/api-docs/rds/proxy/index.html) [iam.Role](/content/registry/packages/aws/api-docs/iam/role/index.html) - Copy Page [Scroll to top](/content/registry/packages/aws/api-docs/secretsmanager/secret/# "Scroll to top"/index.html) #### Try Pulumi Cloud free. Your team will thank you. [Start free trial](https://app.pulumi.com/signup?utm_source=registry&utm_medium=right-rail-banner&utm_campaign=try-pulumi-cloud&iaid=docs-try-pulumi-cloud-ad)