Class: AWSCDK::SecretsManager::CfnSecretProps

Inherits:
Jsii::Struct
  • Object
show all
Defined in:
secrets_manager/cfn_secret_props.rb

Overview

Properties for defining a CfnSecret.

See Also:

Instance Attribute Summary collapse

Class Method Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(description: nil, generate_secret_string: nil, kms_key_id: nil, name: nil, replica_regions: nil, secret_string: nil, tags: nil, type: nil) ⇒ CfnSecretProps

Returns a new instance of CfnSecretProps.

Parameters:

  • description (String, nil) (defaults to: nil) —

    The description of the secret.

  • generate_secret_string (AWSCDK::IResolvable, AWSCDK::SecretsManager::CfnSecret::GenerateSecretStringProperty, nil) (defaults to: nil) —

    A structure that specifies how to generate a password to encrypt and store in the secret.

  • kms_key_id (String, AWSCDK::Interfaces::AWSKMS::IKeyRef, nil) (defaults to: nil) —

    The ARN, key ID, or alias of the AWS key that Secrets Manager uses to encrypt the secret value in the secret.

  • name (String, nil) (defaults to: nil) —

    The name of the new secret.

  • replica_regions (AWSCDK::IResolvable, Array<AWSCDK::IResolvable, AWSCDK::SecretsManager::CfnSecret::ReplicaRegionProperty>, nil) (defaults to: nil) —

    A custom type that specifies a Region and the KmsKeyId for a replica secret.

  • secret_string (String, nil) (defaults to: nil) —

    The text to encrypt and store in the secret.

  • tags (Array<AWSCDK::CfnTag>, nil) (defaults to: nil) —

    A list of tags to attach to the secret.

  • type (String, nil) (defaults to: nil) —

    The exact string that identifies the third-party partner that holds the external secret.



17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
 
# File 'secrets_manager/cfn_secret_props.rb', line 17

def initialize(description: nil, generate_secret_string: nil, kms_key_id: nil, name: nil, replica_regions: nil, secret_string: nil, tags: nil, type: nil)
  @description = description
  Jsii::Type.check_type(@description, JSON.parse(Base64.strict_decode64("eyJwcmltaXRpdmUiOiJzdHJpbmcifQ==")), "description") unless @description.nil?
  @generate_secret_string = generate_secret_string.is_a?(Hash) ? ::AWSCDK::SecretsManager::CfnSecret::GenerateSecretStringProperty.new(**generate_secret_string.transform_keys(&:to_sym)) : generate_secret_string
  Jsii::Type.check_type(@generate_secret_string, JSON.parse(Base64.strict_decode64("eyJ1bmlvbiI6eyJ0eXBlcyI6W3siZnFuIjoiYXdzLWNkay1saWIuSVJlc29sdmFibGUifSx7ImZxbiI6ImF3cy1jZGstbGliLmF3c19zZWNyZXRzbWFuYWdlci5DZm5TZWNyZXQuR2VuZXJhdGVTZWNyZXRTdHJpbmdQcm9wZXJ0eSJ9XX19")), "generateSecretString") unless @generate_secret_string.nil?
  @kms_key_id = kms_key_id
  Jsii::Type.check_type(@kms_key_id, JSON.parse(Base64.strict_decode64("eyJ1bmlvbiI6eyJ0eXBlcyI6W3sicHJpbWl0aXZlIjoic3RyaW5nIn0seyJmcW4iOiJhd3MtY2RrLWxpYi5pbnRlcmZhY2VzLmF3c19rbXMuSUtleVJlZiJ9XX19")), "kmsKeyId") unless @kms_key_id.nil?
  @name = name
  Jsii::Type.check_type(@name, JSON.parse(Base64.strict_decode64("eyJwcmltaXRpdmUiOiJzdHJpbmcifQ==")), "name") unless @name.nil?
  @replica_regions = replica_regions
  Jsii::Type.check_type(@replica_regions, JSON.parse(Base64.strict_decode64("eyJ1bmlvbiI6eyJ0eXBlcyI6W3siZnFuIjoiYXdzLWNkay1saWIuSVJlc29sdmFibGUifSx7ImNvbGxlY3Rpb24iOnsiZWxlbWVudHR5cGUiOnsidW5pb24iOnsidHlwZXMiOlt7ImZxbiI6ImF3cy1jZGstbGliLklSZXNvbHZhYmxlIn0seyJmcW4iOiJhd3MtY2RrLWxpYi5hd3Nfc2VjcmV0c21hbmFnZXIuQ2ZuU2VjcmV0LlJlcGxpY2FSZWdpb25Qcm9wZXJ0eSJ9XX19LCJraW5kIjoiYXJyYXkifX1dfX0=")), "replicaRegions") unless @replica_regions.nil?
  @secret_string = secret_string
  Jsii::Type.check_type(@secret_string, JSON.parse(Base64.strict_decode64("eyJwcmltaXRpdmUiOiJzdHJpbmcifQ==")), "secretString") unless @secret_string.nil?
  @tags = tags.is_a?(Array) ? tags.map { |jsii_v0| jsii_v0.is_a?(Hash) ? ::AWSCDK::CfnTag.new(**jsii_v0.transform_keys(&:to_sym)) : jsii_v0 } : tags
  Jsii::Type.check_type(@tags, JSON.parse(Base64.strict_decode64("eyJjb2xsZWN0aW9uIjp7ImVsZW1lbnR0eXBlIjp7ImZxbiI6ImF3cy1jZGstbGliLkNmblRhZyJ9LCJraW5kIjoiYXJyYXkifX0=")), "tags") unless @tags.nil?
  @type = type
  Jsii::Type.check_type(@type, JSON.parse(Base64.strict_decode64("eyJwcmltaXRpdmUiOiJzdHJpbmcifQ==")), "type") unless @type.nil?
end

Instance Attribute Details

#description ⇒ String? (readonly)

The description of the secret.

Returns:

  • (String, nil)

See Also:



40
41
42
 
# File 'secrets_manager/cfn_secret_props.rb', line 40

def description
  @description
end

#generate_secret_string ⇒ AWSCDK::IResolvable, ... (readonly)

A structure that specifies how to generate a password to encrypt and store in the secret.

To include a specific string in the secret, use SecretString instead. If you omit both GenerateSecretString and SecretString , you create an empty secret. When you make a change to this property, a new secret version is created.

We recommend that you specify the maximum length and include every character type that the system you are generating a password for can support.

Returns:

See Also:



49
50
51
 
# File 'secrets_manager/cfn_secret_props.rb', line 49

def generate_secret_string
  @generate_secret_string
end

#kms_key_id ⇒ String, ... (readonly)

The ARN, key ID, or alias of the AWS key that Secrets Manager uses to encrypt the secret value in the secret.

An alias is always prefixed by alias/ , for example alias/aws/secretsmanager . For more information, see About aliases .

To use a AWS key in a different account, use the key ARN or the alias ARN.

If you don't specify this value, then Secrets Manager uses the key aws/secretsmanager . If that key doesn't yet exist, then Secrets Manager creates it for you automatically the first time it encrypts the secret value.

If the secret is in a different AWS account from the credentials calling the API, then you can't use aws/secretsmanager to encrypt the secret, and you must create and use a customer managed AWS key.

Returns:

See Also:



62
63
64
 
# File 'secrets_manager/cfn_secret_props.rb', line 62

def kms_key_id
  @kms_key_id
end

#name ⇒ String? (readonly)

The name of the new secret.

The secret name can contain ASCII letters, numbers, and the following characters: /_+=.@-

Do not end your secret name with a hyphen followed by six characters. If you do so, you risk confusion and unexpected results when searching for a secret by partial ARN. Secrets Manager automatically adds a hyphen and six random characters after the secret name at the end of the ARN.

Returns:

  • (String, nil)

See Also:



71
72
73
 
# File 'secrets_manager/cfn_secret_props.rb', line 71

def name
  @name
end

#replica_regions ⇒ AWSCDK::IResolvable, ... (readonly)

A custom type that specifies a Region and the KmsKeyId for a replica secret.

Returns:

See Also:



76
77
78
 
# File 'secrets_manager/cfn_secret_props.rb', line 76

def replica_regions
  @replica_regions
end

#secret_string ⇒ String? (readonly)

The text to encrypt and store in the secret.

We recommend you use a JSON structure of key/value pairs for your secret value. To generate a random password, use GenerateSecretString instead. If you omit both GenerateSecretString and SecretString , you create an empty secret. When you make a change to this property, a new secret version is created.

Returns:

  • (String, nil)

See Also:



83
84
85
 
# File 'secrets_manager/cfn_secret_props.rb', line 83

def secret_string
  @secret_string
end

#tags ⇒ Array<AWSCDK::CfnTag>? (readonly)

A list of tags to attach to the secret.

Each tag is a key and value pair of strings in a JSON text string, for example:

[{"Key":"CostCenter","Value":"12345"},{"Key":"environment","Value":"production"}]

Secrets Manager tag key names are case sensitive. A tag with the key "ABC" is a different tag from one with key "abc".

Stack-level tags, tags you apply to the CloudFormation stack, are also attached to the secret.

If you check tags in permissions policies as part of your security strategy, then adding or removing a tag can change permissions. If the completion of this operation would result in you losing your permissions for this secret, then Secrets Manager blocks the operation and returns an Access Denied error. For more information, see Control access to secrets using tags and Limit access to identities with tags that match secrets' tags .

For information about how to format a JSON parameter for the various command line tool environments, see Using JSON for Parameters . If your command-line tool or SDK requires quotation marks around the parameter, you should use single quotes to avoid confusion with the double quotes required in the JSON text.

The following restrictions apply to tags:

  • Maximum number of tags per secret: 50
  • Maximum key length: 127 Unicode characters in UTF-8
  • Maximum value length: 255 Unicode characters in UTF-8
  • Tag keys and values are case sensitive.
  • Do not use the aws: prefix in your tag names or values because AWS reserves it for AWS use. You can't edit or delete tag names or values with this prefix. Tags with this prefix do not count against your tags per secret limit.
  • If you use your tagging schema across multiple services and resources, other services might have restrictions on allowed characters. Generally allowed characters: letters, spaces, and numbers representable in UTF-8, plus the following special characters: + - = . _ : /

Returns:

See Also:



109
110
111
 
# File 'secrets_manager/cfn_secret_props.rb', line 109

def tags
  @tags
end

#type ⇒ String? (readonly)

The exact string that identifies the third-party partner that holds the external secret.

For more information, see Managed external secret partners .

Returns:

  • (String, nil)

See Also:



116
117
118
 
# File 'secrets_manager/cfn_secret_props.rb', line 116

def type
  @type
end

Class Method Details

.jsii_properties ⇒ Object 



118
119
120
121
122
123
124
125
126
127
128
129
 
# File 'secrets_manager/cfn_secret_props.rb', line 118

def self.jsii_properties
  {
    :description => "description",
    :generate_secret_string => "generateSecretString",
    :kms_key_id => "kmsKeyId",
    :name => "name",
    :replica_regions => "replicaRegions",
    :secret_string => "secretString",
    :tags => "tags",
    :type => "type",
  }
end

Instance Method Details

#to_jsii ⇒ Object 



131
132
133
134
135
136
137
138
139
140
141
142
143
144
 
# File 'secrets_manager/cfn_secret_props.rb', line 131

def to_jsii
  result = {}
  result.merge!({
    "description" => @description,
    "generateSecretString" => @generate_secret_string,
    "kmsKeyId" => @kms_key_id,
    "name" => @name,
    "replicaRegions" => @replica_regions,
    "secretString" => @secret_string,
    "tags" => @tags,
    "type" => @type,
  })
  result.compact
end