Class SecretProps

Namespace

Amazon.CDK.AWS.SecretsManager

Assembly

Amazon.CDK.AWS.SecretsManager.dll

The properties required to create a new secret in AWS Secrets Manager.

public class SecretProps : ISecretProps

Inheritance

object

SecretProps

Implements

ISecretProps

Inherited Members

object.GetType()

object.MemberwiseClone()

object.ToString()

object.Equals(object)

object.Equals(object, object)

object.ReferenceEquals(object, object)

object.GetHashCode()

Examples

// Creates a new IAM user, access and secret keys, and stores the secret access key in a Secret.
            var user = new User(this, "User");
            var accessKey = new AccessKey(this, "AccessKey", new AccessKeyProps { User = user });
            var secretValue = SecretStringValueBeta1.FromToken(accessKey.SecretAccessKey.ToString());
            new Secret(this, "Secret", new SecretProps {
                SecretStringBeta1 = secretValue
            });

Remarks

ExampleMetadata: infused

Constructors

SecretProps()

public SecretProps()

Properties

Description

An optional, human-friendly description of the secret.

public string? Description { get; set; }

Property Value

string

Remarks

Default: - No description.

EncryptionKey

The customer-managed encryption key to use for encrypting the secret value.

public IKey? EncryptionKey { get; set; }

Property Value

IKey

Remarks

Default: - A default KMS key for the account and region is used.

GenerateSecretString

Configuration for how to generate a secret value.

public ISecretStringGenerator? GenerateSecretString { get; set; }

Property Value

ISecretStringGenerator

Remarks

Only one of secretString and generateSecretString can be provided.

Default: - 32 characters with upper-case letters, lower-case letters, punctuation and numbers (at least one from each category), per the default values of SecretStringGenerator.

RemovalPolicy

Policy to apply when the secret is removed from this stack.

public RemovalPolicy?? RemovalPolicy { get; set; }

Property Value

RemovalPolicy?

Remarks

Default: - Not set.

ReplicaRegions

A list of regions where to replicate this secret.

public IReplicaRegion[]? ReplicaRegions { get; set; }

Property Value

IReplicaRegion[]

Remarks

Default: - Secret is not replicated

SecretName

A name for the secret.

public string? SecretName { get; set; }

Property Value

string

Remarks

Note that deleting secrets from SecretsManager does not happen immediately, but after a 7 to 30 days blackout period. During that period, it is not possible to create another secret that shares the same name.

Default: - A name is generated by CloudFormation.

SecretStringBeta1

(deprecated) Initial value for the secret.

[Obsolete("Use `secretStringValue` instead.")]
public SecretStringValueBeta1? SecretStringBeta1 { get; set; }

Property Value

SecretStringValueBeta1

Remarks

NOTE: *It is highly encouraged to leave this field undefined and allow SecretsManager to create the secret value. The secret string -- if provided -- will be included in the output of the cdk as part of synthesis, and will appear in the CloudFormation template in the console. This can be secure(-ish) if that value is merely reference to another resource (or one of its attributes), but if the value is a plaintext string, it will be visible to anyone with access to the CloudFormation template (via the AWS Console, SDKs, or CLI).

Specifies text data that you want to encrypt and store in this new version of the secret. May be a simple string value, or a string representation of a JSON structure.

Only one of secretStringBeta1, secretStringValue, and generateSecretString can be provided.

Default: - SecretsManager generates a new secret value.

Stability: Deprecated

SecretStringValue

Initial value for the secret.

public SecretValue? SecretStringValue { get; set; }

Property Value

SecretValue

Remarks

NOTE: *It is highly encouraged to leave this field undefined and allow SecretsManager to create the secret value. The secret string -- if provided -- will be included in the output of the cdk as part of synthesis, and will appear in the CloudFormation template in the console. This can be secure(-ish) if that value is merely reference to another resource (or one of its attributes), but if the value is a plaintext string, it will be visible to anyone with access to the CloudFormation template (via the AWS Console, SDKs, or CLI).

Specifies text data that you want to encrypt and store in this new version of the secret. May be a simple string value, or a string representation of a JSON structure.

Only one of secretStringBeta1, secretStringValue, and generateSecretString can be provided.

Default: - SecretsManager generates a new secret value.