Skip to main content
Use this provider when you want managed secret storage in AWS.

​
Environment Variables

VariableRequiredNotes
SECRETS_MANAGER_TYPEYesSet to aws_secrets_manager.
SECRETS_MANAGER_REGIONYesAWS region for Secrets Manager API calls.
SECRETS_MANAGER_ACCESS_KEY_IDOptionalUse with SECRETS_MANAGER_SECRET_ACCESS_KEY for static credentials.
SECRETS_MANAGER_SECRET_ACCESS_KEYOptionalUse with SECRETS_MANAGER_ACCESS_KEY_ID for static credentials.
SECRETS_MANAGER_ROLE_ARNOptionalRole to assume.
SECRETS_MANAGER_EXTERNAL_IDOptionalExternal ID when required by role trust policy.
Use one of these auth modes:
  • Static access keys.
  • Assume role (SECRETS_MANAGER_ROLE_ARN) with a valid base identity.
  • Default AWS credential chain.

​
Create AWS Resources and Credentials

  1. Pick the region where secrets will be stored.
  2. Create an IAM identity for wonderful-secrets:
    • User flow: IAM -> Users -> Create user.
    • Role flow: IAM -> Roles -> Create role.
  3. Grant Secrets Manager permissions. Minimum actions:
    • secretsmanager:GetSecretValue
    • secretsmanager:CreateSecret
    • secretsmanager:UpdateSecret
    • secretsmanager:DeleteSecret
    • secretsmanager:RestoreSecret
  4. If using static credentials:
    • IAM -> Users -> <user> -> Security credentials -> Create access key.
    • Copy Access key ID and Secret access key.
  5. If using role assumption:
    • IAM -> Roles -> <role> -> copy role ARN.
    • If trust policy requires external ID, copy that value too.

​
Map Credentials to Env Vars

AWS valueEnv var
RegionSECRETS_MANAGER_REGION
Access key IDSECRETS_MANAGER_ACCESS_KEY_ID
Secret access keySECRETS_MANAGER_SECRET_ACCESS_KEY
Role ARNSECRETS_MANAGER_ROLE_ARN
External IDSECRETS_MANAGER_EXTERNAL_ID

​
Local Switch Example

# env_files/secrets.env
SECRETS_MANAGER_TYPE=aws_secrets_manager
SECRETS_MANAGER_REGION=eu-central-1
SECRETS_MANAGER_ACCESS_KEY_ID=<access-key-id>
SECRETS_MANAGER_SECRET_ACCESS_KEY=<secret-access-key>
# Optional
# SECRETS_MANAGER_ROLE_ARN=arn:aws:iam::<account-id>:role/<role-name>
# SECRETS_MANAGER_EXTERNAL_ID=<external-id>
Restart wonderful-secrets after changing these values.

​
What to Verify

  1. Run the smoke test from Secret Managers.
  2. Confirm secrets are created in AWS Secrets Manager.