Overview
AWS Secrets Manager is AWS's managed secret storage service with automatic rotation. The Automize AWS Secrets Manager connector covers secret CRUD, versioning, rotation triggers, tagging, and random password generation.
- Regions: Secrets Manager is regional. Each secret lives in one region (with optional cross-region replication).
- Plans: $0.40/month per secret stored + $0.05 per 10k API calls.
Setting up the connection
Auth type: aws_sigv4.
- AWS Console → IAM → user with programmatic access.
- Attach SecretsManagerReadWrite or scope to specific secret ARNs (recommended for least-privilege).
- In Automize, open Settings → Connectors → AWS Secrets Manager → Add connection. Paste keys + region.
Find your credentials at https://us-east-1.console.aws.amazon.com/iam/home.
Rate limits
Per-account per-region limits – typically 1500 req/sec on most APIs. Connector retries Throttling errors.
Data model
Secrets primitives:
Secret ─┬─ Versions (immutable snapshots, each with stages: AWSCURRENT, AWSPENDING, AWSPREVIOUS)
├─ Tags
└─ Rotation Schedule (via Lambda function)Available operations
13 operations available. Click any row to jump to its detail.
| Operation | Category | What it does |
|---|---|---|
| Create Secret | General | Create a new secret |
| Delete Secret | General | Delete a secret (with optional recovery window) |
| Describe Secret | General | Get secret metadata without the value |
| Get Random Password | General | Generate a random password |
| Get Secret Value | General | Retrieve the value of a secret |
| List Secret Version IDs | General | List all versions of a secret |
| List Secrets | General | List all secrets in the account |
| Put Secret Value | General | Store a new version of a secret value |
| Restore Secret | General | Restore a previously deleted secret |
| Rotate Secret | General | Trigger rotation for a secret |
| Tag Resource | General | Add tags to a secret |
| Untag Resource | General | Remove tags from a secret |
| Update Secret | General | Update a secret value or metadata |
Operations
Create Secret
Create a new secret
No input parameters.
Tips
- Name + SecretString (or SecretBinary). Tags optional.
- KMS encryption: KmsKeyId; defaults to AWS-managed key if not set.
Delete Secret
Delete a secret (with optional recovery window)
No input parameters.
Tips
- Soft-delete with default 30-day recovery window. RecoveryWindowInDays: 7-30.
- ForceDeleteWithoutRecovery=true for immediate hard-delete (irreversible).
Describe Secret
Get secret metadata without the value
No input parameters.
Tips
- Returns metadata: tags, rotation config, version stages. Does NOT return the secret value.
Get Random Password
Generate a random password
No input parameters.
Tips
- Generate a random password (no secret stored). PasswordLength + IncludeSpace + ExcludePunctuation + RequireEachIncludedType.
Get Secret Value
Retrieve the value of a secret
No input parameters.
Tips
- Returns the value. Defaults to AWSCURRENT version; pass VersionId or VersionStage to override.
List Secret Version IDs
List all versions of a secret
No input parameters.
Tips
- Returns version IDs + stage labels. Useful for rollback.
List Secrets
List all secrets in the account
No input parameters.
Tips
- Filter by Filters[] (key:'name','description','tag-key','tag-value','primary-region','owning-service').
- Pages 100 per call.
Put Secret Value
Store a new version of a secret value
No input parameters.
Tips
- Creates a new version. By default marks it AWSCURRENT. Previous version becomes AWSPREVIOUS.
Restore Secret
Restore a previously deleted secret
No input parameters.
Tips
- Cancel scheduled deletion within the recovery window.
Rotate Secret
Trigger rotation for a secret
No input parameters.
Tips
- Trigger rotation. RotateImmediately=true forces immediate rotation.
- Requires a Lambda function configured for rotation – see Configure Rotation (not exposed here).
Tag Resource
Add tags to a secret
No input parameters.
Tips
- Tags: [{Key, Value}, ...]. Useful for grouping secrets by service/environment.
Untag Resource
Remove tags from a secret
No input parameters.
Tips
- TagKeys[] – remove tags by key.
Update Secret
Update a secret value or metadata
No input parameters.
Tips
- Update metadata (description, KMS key). For new value, use Put Secret Value (creates a new version).
FAQ
- Why is my secret cached?
- Get Secret Value is throttled – AWS SDKs typically cache the value for ~5 mins. Direct API calls don't cache by default. For high-volume access, use the Secrets Manager Agent or in-app caching.
- Automatic rotation – how?
- Configure Rotation (in AWS Console or via the API) wires a Lambda function to rotate the secret on schedule. The Lambda needs to know how to rotate the specific service (DB password change, API key reissue, etc.). AWS provides templates for RDS, DocumentDB, Redshift.
- Cross-region replication?
- Replicate Secret To Regions[] when creating. Replicated secrets are read-only in the secondary region.