Class: AWSCDK::SecretsManager::SecretTargetAttachment

Inherits:
Resource
  • Object
show all
Includes:
ISecret, ISecretTargetAttachment
Defined in:
secrets_manager/secret_target_attachment.rb

Overview

An attached secret.

Class Method Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(scope, id, props) ⇒ SecretTargetAttachment

Returns a new instance of SecretTargetAttachment.

Parameters:



13
14
15
16
17
18
19
 
# File 'secrets_manager/secret_target_attachment.rb', line 13

def initialize(scope, id, props)
  props = props.is_a?(Hash) ? ::AWSCDK::SecretsManager::SecretTargetAttachmentProps.new(**props.transform_keys(&:to_sym)) : props
  Jsii::Type.check_type(scope, JSON.parse(Base64.strict_decode64("eyJmcW4iOiJjb25zdHJ1Y3RzLkNvbnN0cnVjdCJ9")), "scope")
  Jsii::Type.check_type(id, JSON.parse(Base64.strict_decode64("eyJwcmltaXRpdmUiOiJzdHJpbmcifQ==")), "id")
  Jsii::Type.check_type(props, JSON.parse(Base64.strict_decode64("eyJmcW4iOiJhd3MtY2RrLWxpYi5hd3Nfc2VjcmV0c21hbmFnZXIuU2VjcmV0VGFyZ2V0QXR0YWNobWVudFByb3BzIn0=")), "props")
  Jsii::Object.instance_method(:initialize).bind(self).call(scope, id, props)
end

Class Method Details

.from_secret_target_attachment_secret_arn(scope, id, secret_target_attachment_secret_arn) ⇒ AWSCDK::SecretsManager::ISecretTargetAttachment

Parameters:

  • scope (Constructs::Construct)
  • id (String)
  • secret_target_attachment_secret_arn (String)

Returns:



59
60
61
62
63
64
 
# File 'secrets_manager/secret_target_attachment.rb', line 59

def self.from_secret_target_attachment_secret_arn(scope, id, secret_target_attachment_secret_arn)
  Jsii::Type.check_type(scope, JSON.parse(Base64.strict_decode64("eyJmcW4iOiJjb25zdHJ1Y3RzLkNvbnN0cnVjdCJ9")), "scope")
  Jsii::Type.check_type(id, JSON.parse(Base64.strict_decode64("eyJwcmltaXRpdmUiOiJzdHJpbmcifQ==")), "id")
  Jsii::Type.check_type(secret_target_attachment_secret_arn, JSON.parse(Base64.strict_decode64("eyJwcmltaXRpdmUiOiJzdHJpbmcifQ==")), "secretTargetAttachmentSecretArn")
  Jsii::Kernel.instance.call_static("aws-cdk-lib.aws_secretsmanager.SecretTargetAttachment", "fromSecretTargetAttachmentSecretArn", [scope, id, secret_target_attachment_secret_arn])
end

.jsii_overridable_methods ⇒ Object 



21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
 
# File 'secrets_manager/secret_target_attachment.rb', line 21

def self.jsii_overridable_methods
  {
    :node => { kind: :property, name: "node", is_optional: false },
    :env => { kind: :property, name: "env", is_optional: false },
    :physical_name => { kind: :property, name: "physicalName", is_optional: false },
    :stack => { kind: :property, name: "stack", is_optional: false },
    :arn_for_policies => { kind: :property, name: "arnForPolicies", is_optional: false },
    :auto_create_policy => { kind: :property, name: "autoCreatePolicy", is_optional: false },
    :secret_arn => { kind: :property, name: "secretArn", is_optional: false },
    :secret_name => { kind: :property, name: "secretName", is_optional: false },
    :secret_ref => { kind: :property, name: "secretRef", is_optional: false },
    :secret_target_attachment_ref => { kind: :property, name: "secretTargetAttachmentRef", is_optional: false },
    :secret_target_attachment_secret_arn => { kind: :property, name: "secretTargetAttachmentSecretArn", is_optional: false },
    :secret_value => { kind: :property, name: "secretValue", is_optional: false },
    :encryption_key => { kind: :property, name: "encryptionKey", is_optional: true },
    :secret_full_arn => { kind: :property, name: "secretFullArn", is_optional: true },
    :to_string => { kind: :method, name: "toString", is_optional: false },
    :with => { kind: :method, name: "with", is_optional: false },
    :apply_cross_stack_reference_strength => { kind: :method, name: "applyCrossStackReferenceStrength", is_optional: false },
    :apply_removal_policy => { kind: :method, name: "applyRemovalPolicy", is_optional: false },
    :generate_physical_name => { kind: :method, name: "generatePhysicalName", is_optional: false },
    :get_resource_arn_attribute => { kind: :method, name: "getResourceArnAttribute", is_optional: false },
    :get_resource_name_attribute => { kind: :method, name: "getResourceNameAttribute", is_optional: false },
    :add_rotation_schedule => { kind: :method, name: "addRotationSchedule", is_optional: false },
    :add_to_resource_policy => { kind: :method, name: "addToResourcePolicy", is_optional: false },
    :attach => { kind: :method, name: "attach", is_optional: false },
    :cfn_dynamic_reference_key => { kind: :method, name: "cfnDynamicReferenceKey", is_optional: false },
    :deny_account_root_delete => { kind: :method, name: "denyAccountRootDelete", is_optional: false },
    :grant_read => { kind: :method, name: "grantRead", is_optional: false },
    :grant_write => { kind: :method, name: "grantWrite", is_optional: false },
    :secret_value_from_json => { kind: :method, name: "secretValueFromJson", is_optional: false },
  }
end

.PROPERTY_INJECTION_ID ⇒ String

Uniquely identifies this class.

Returns:

  • (String) 


112
113
114
 
# File 'secrets_manager/secret_target_attachment.rb', line 112

def self.PROPERTY_INJECTION_ID()
  Jsii::Kernel.instance.get_static("aws-cdk-lib.aws_secretsmanager.SecretTargetAttachment", "PROPERTY_INJECTION_ID")
end

Instance Method Details

#add_rotation_schedule(id, options) ⇒ AWSCDK::SecretsManager::RotationSchedule

Adds a rotation schedule to the secret.

Parameters:

Returns:



294
295
296
297
298
299
 
# File 'secrets_manager/secret_target_attachment.rb', line 294

def add_rotation_schedule(id, options)
  Jsii::Type.check_type(id, JSON.parse(Base64.strict_decode64("eyJwcmltaXRpdmUiOiJzdHJpbmcifQ==")), "id")
  options = options.is_a?(Hash) ? ::AWSCDK::SecretsManager::RotationScheduleOptions.new(**options.transform_keys(&:to_sym)) : options
  Jsii::Type.check_type(options, JSON.parse(Base64.strict_decode64("eyJmcW4iOiJhd3MtY2RrLWxpYi5hd3Nfc2VjcmV0c21hbmFnZXIuUm90YXRpb25TY2hlZHVsZU9wdGlvbnMifQ==")), "options")
  jsii_call_method("addRotationSchedule", [id, options])
end

#add_to_resource_policy(statement) ⇒ AWSCDK::IAM::AddToResourcePolicyResult

Forward any additions to the resource policy to the original secret.

This is required because a secret can only have a single resource policy. If we do not forward policy additions, a new policy resource is created using the secret attachment ARN. This ends up being rejected by CloudFormation.

Parameters:

Returns:



309
310
311
312
 
# File 'secrets_manager/secret_target_attachment.rb', line 309

def add_to_resource_policy(statement)
  Jsii::Type.check_type(statement, JSON.parse(Base64.strict_decode64("eyJmcW4iOiJhd3MtY2RrLWxpYi5hd3NfaWFtLlBvbGljeVN0YXRlbWVudCJ9")), "statement")
  jsii_call_method("addToResourcePolicy", [statement])
end

#apply_cross_stack_reference_strength(strength) ⇒ void

This method returns an undefined value.

Override the cross-stack reference strength for this resource.

When set, any cross-stack reference to this resource will use the specified mechanism instead of the global default determined by the @aws-cdk/core:defaultCrossStackReferences context key. This is useful for selectively weakening specific references to avoid the "deadly embrace" problem without changing the app-wide default.

Parameters:



232
233
234
235
 
# File 'secrets_manager/secret_target_attachment.rb', line 232

def apply_cross_stack_reference_strength(strength)
  Jsii::Type.check_type(strength, JSON.parse(Base64.strict_decode64("eyJmcW4iOiJhd3MtY2RrLWxpYi5SZWZlcmVuY2VTdHJlbmd0aCJ9")), "strength")
  jsii_call_method("applyCrossStackReferenceStrength", [strength])
end

#apply_removal_policy(policy) ⇒ void

This method returns an undefined value.

Apply the given removal policy to this resource.

The Removal Policy controls what happens to this resource when it stops being managed by CloudFormation, either because you've removed it from the CDK application or because you've made a change that requires the resource to be replaced.

The resource can be deleted (RemovalPolicy.DESTROY), or left in your AWS account for data recovery and cleanup later (RemovalPolicy.RETAIN).

Parameters:



249
250
251
252
 
# File 'secrets_manager/secret_target_attachment.rb', line 249

def apply_removal_policy(policy)
  Jsii::Type.check_type(policy, JSON.parse(Base64.strict_decode64("eyJmcW4iOiJhd3MtY2RrLWxpYi5SZW1vdmFsUG9saWN5In0=")), "policy")
  jsii_call_method("applyRemovalPolicy", [policy])
end

#arn_for_policies ⇒ String

Provides an identifier for this secret for use in IAM policies.

If there is a full ARN, this is just the ARN; if we have a partial ARN -- due to either importing by secret name or partial ARN -- then we need to add a suffix to capture the full ARN's format.

Returns:

  • (String) 


123
124
125
 
# File 'secrets_manager/secret_target_attachment.rb', line 123

def arn_for_policies()
  jsii_get_property("arnForPolicies")
end

#attach(target) ⇒ AWSCDK::SecretsManager::ISecret

Attach a target to this secret.

Parameters:

Returns:



318
319
320
321
 
# File 'secrets_manager/secret_target_attachment.rb', line 318

def attach(target)
  Jsii::Type.check_type(target, JSON.parse(Base64.strict_decode64("eyJmcW4iOiJhd3MtY2RrLWxpYi5hd3Nfc2VjcmV0c21hbmFnZXIuSVNlY3JldEF0dGFjaG1lbnRUYXJnZXQifQ==")), "target")
  jsii_call_method("attach", [target])
end

#auto_create_policy ⇒ Boolean

Returns:

  • (Boolean) 


128
129
130
 
# File 'secrets_manager/secret_target_attachment.rb', line 128

def auto_create_policy()
  jsii_get_property("autoCreatePolicy")
end

#cfn_dynamic_reference_key(options = nil) ⇒ String

Returns a key which can be used within an AWS CloudFormation dynamic reference to dynamically load this secret from AWS Secrets Manager.

Parameters:

Returns:

  • (String)

See Also:



328
329
330
331
332
 
# File 'secrets_manager/secret_target_attachment.rb', line 328

def cfn_dynamic_reference_key(options = nil)
  options = options.is_a?(Hash) ? ::AWSCDK::SecretsManagerSecretOptions.new(**options.transform_keys(&:to_sym)) : options
  Jsii::Type.check_type(options, JSON.parse(Base64.strict_decode64("eyJmcW4iOiJhd3MtY2RrLWxpYi5TZWNyZXRzTWFuYWdlclNlY3JldE9wdGlvbnMifQ==")), "options") unless options.nil?
  jsii_call_method("cfnDynamicReferenceKey", [options])
end

#deny_account_root_delete ⇒ void

This method returns an undefined value.

Denies the DeleteSecret action to all principals within the current account.



337
338
339
 
# File 'secrets_manager/secret_target_attachment.rb', line 337

def ()
  jsii_call_method("denyAccountRootDelete", [])
end

#encryption_key ⇒ AWSCDK::KMS::IKey?

The customer-managed encryption key that is used to encrypt this secret, if any.

When not specified, the default KMS key for the account and region is being used.

Returns:



186
187
188
 
# File 'secrets_manager/secret_target_attachment.rb', line 186

def encryption_key()
  jsii_get_property("encryptionKey")
end

#env ⇒ AWSCDK::Interfaces::ResourceEnvironment

The environment this resource belongs to.

For resources that are created and managed in a Stack (those created by creating new class instances like new Role(), new Bucket(), etc.), this is always the same as the environment of the stack they belong to.

For referenced resources (those obtained from referencing methods like Role.fromRoleArn(), Bucket.fromBucketName(), etc.), they might be different than the stack they were imported into.

Returns:



84
85
86
 
# File 'secrets_manager/secret_target_attachment.rb', line 84

def env()
  jsii_get_property("env")
end

#generate_physical_name ⇒ String

Returns:

  • (String) 


255
256
257
 
# File 'secrets_manager/secret_target_attachment.rb', line 255

def generate_physical_name()
  jsii_call_method("generatePhysicalName", [])
end

#get_resource_arn_attribute(arn_attr, arn_components) ⇒ String

Returns an environment-sensitive token that should be used for the resource's "ARN" attribute (e.g. bucket.bucketArn).

Normally, this token will resolve to arn_attr, but if the resource is referenced across environments, arn_components will be used to synthesize a concrete ARN with the resource's physical name. Make sure to reference this.physicalName in arn_components.

Parameters:

  • arn_attr (String) —

    The CFN attribute which resolves to the ARN of the resource.

  • arn_components (AWSCDK::ARNComponents) —

    The format of the ARN of this resource.

Returns:

  • (String) 


269
270
271
272
273
274
 
# File 'secrets_manager/secret_target_attachment.rb', line 269

def get_resource_arn_attribute(arn_attr, arn_components)
  Jsii::Type.check_type(arn_attr, JSON.parse(Base64.strict_decode64("eyJwcmltaXRpdmUiOiJzdHJpbmcifQ==")), "arnAttr")
  arn_components = arn_components.is_a?(Hash) ? ::AWSCDK::ARNComponents.new(**arn_components.transform_keys(&:to_sym)) : arn_components
  Jsii::Type.check_type(arn_components, JSON.parse(Base64.strict_decode64("eyJmcW4iOiJhd3MtY2RrLWxpYi5Bcm5Db21wb25lbnRzIn0=")), "arnComponents")
  jsii_call_method("getResourceArnAttribute", [arn_attr, arn_components])
end

#get_resource_name_attribute(name_attr) ⇒ String

Returns an environment-sensitive token that should be used for the resource's "name" attribute (e.g. bucket.bucketName).

Normally, this token will resolve to name_attr, but if the resource is referenced across environments, it will be resolved to this.physicalName, which will be a concrete name.

Parameters:

  • name_attr (String) —

    The CFN attribute which resolves to the resource's name.

Returns:

  • (String) 


284
285
286
287
 
# File 'secrets_manager/secret_target_attachment.rb', line 284

def get_resource_name_attribute(name_attr)
  Jsii::Type.check_type(name_attr, JSON.parse(Base64.strict_decode64("eyJwcmltaXRpdmUiOiJzdHJpbmcifQ==")), "nameAttr")
  jsii_call_method("getResourceNameAttribute", [name_attr])
end

#grant_read(grantee, version_stages = nil) ⇒ AWSCDK::IAM::Grant

[disable-awslint:no-grants].

Parameters:

Returns:



346
347
348
349
350
 
# File 'secrets_manager/secret_target_attachment.rb', line 346

def grant_read(grantee, version_stages = nil)
  Jsii::Type.check_type(grantee, JSON.parse(Base64.strict_decode64("eyJmcW4iOiJhd3MtY2RrLWxpYi5hd3NfaWFtLklHcmFudGFibGUifQ==")), "grantee")
  Jsii::Type.check_type(version_stages, JSON.parse(Base64.strict_decode64("eyJjb2xsZWN0aW9uIjp7ImVsZW1lbnR0eXBlIjp7InByaW1pdGl2ZSI6InN0cmluZyJ9LCJraW5kIjoiYXJyYXkifX0=")), "versionStages") unless version_stages.nil?
  jsii_call_method("grantRead", [grantee, version_stages])
end

#grant_write(grantee) ⇒ AWSCDK::IAM::Grant

[disable-awslint:no-grants].

Parameters:

Returns:



356
357
358
359
 
# File 'secrets_manager/secret_target_attachment.rb', line 356

def grant_write(grantee)
  Jsii::Type.check_type(grantee, JSON.parse(Base64.strict_decode64("eyJmcW4iOiJhd3MtY2RrLWxpYi5hd3NfaWFtLklHcmFudGFibGUifQ==")), "grantee")
  jsii_call_method("grantWrite", [grantee])
end

#node ⇒ Constructs::Node

The tree node.

Returns:

  • (Constructs::Node) 


69
70
71
 
# File 'secrets_manager/secret_target_attachment.rb', line 69

def node()
  jsii_get_property("node")
end

#physical_name ⇒ String

Returns a string-encoded token that resolves to the physical name that should be passed to the CloudFormation resource.

This value will resolve to one of the following:

  • a concrete value (e.g. "my-awesome-bucket")
  • undefined, when a name should be generated by CloudFormation
  • a concrete name generated automatically during synthesis, in cross-environment scenarios.

Returns:

  • (String) 


98
99
100
 
# File 'secrets_manager/secret_target_attachment.rb', line 98

def physical_name()
  jsii_get_property("physicalName")
end

#secret_arn ⇒ String

The ARN of the secret in AWS Secrets Manager.

Will return the full ARN if available, otherwise a partial arn. For secrets imported by the deprecated from_secret_name, it will return the secret_name.

Returns:

  • (String) 


138
139
140
 
# File 'secrets_manager/secret_target_attachment.rb', line 138

def secret_arn()
  jsii_get_property("secretArn")
end

#secret_full_arn ⇒ String?

The full ARN of the secret in AWS Secrets Manager, which is the ARN including the Secrets Manager-supplied 6-character suffix.

This is equal to secret_arn in most cases, but is undefined when a full ARN is not available (e.g., secrets imported by name).

Returns:

  • (String, nil) 


195
196
197
 
# File 'secrets_manager/secret_target_attachment.rb', line 195

def secret_full_arn()
  jsii_get_property("secretFullArn")
end

#secret_name ⇒ String

The name of the secret.

For "owned" secrets, this will be the full resource name (secret name + suffix), unless the '@aws-cdk/aws-secretsmanager:parseOwnedSecretName' feature flag is set.

Returns:

  • (String) 


148
149
150
 
# File 'secrets_manager/secret_target_attachment.rb', line 148

def secret_name()
  jsii_get_property("secretName")
end

#secret_ref ⇒ AWSCDK::Interfaces::AWSSecretsmanager::SecretReference

A reference to a Secret resource.

Returns:



155
156
157
 
# File 'secrets_manager/secret_target_attachment.rb', line 155

def secret_ref()
  jsii_get_property("secretRef")
end

#secret_target_attachment_ref ⇒ AWSCDK::Interfaces::AWSSecretsmanager::SecretTargetAttachmentReference

A reference to a SecretTargetAttachment resource.

Returns:



162
163
164
 
# File 'secrets_manager/secret_target_attachment.rb', line 162

def secret_target_attachment_ref()
  jsii_get_property("secretTargetAttachmentRef")
end

#secret_target_attachment_secret_arn ⇒ String

Same as secretArn.

Returns:

  • (String) 


169
170
171
 
# File 'secrets_manager/secret_target_attachment.rb', line 169

def secret_target_attachment_secret_arn()
  jsii_get_property("secretTargetAttachmentSecretArn")
end

#secret_value ⇒ AWSCDK::SecretValue

Retrieve the value of the stored secret as a SecretValue.

Returns:



176
177
178
 
# File 'secrets_manager/secret_target_attachment.rb', line 176

def secret_value()
  jsii_get_property("secretValue")
end

#secret_value_from_json(json_field) ⇒ AWSCDK::SecretValue

Interpret the secret as a JSON object and return a field's value from it as a SecretValue.

Parameters:

  • json_field (String)

Returns:



365
366
367
368
 
# File 'secrets_manager/secret_target_attachment.rb', line 365

def secret_value_from_json(json_field)
  Jsii::Type.check_type(json_field, JSON.parse(Base64.strict_decode64("eyJwcmltaXRpdmUiOiJzdHJpbmcifQ==")), "jsonField")
  jsii_call_method("secretValueFromJson", [json_field])
end

#stack ⇒ AWSCDK::Stack

The stack in which this resource is defined.

Returns:



105
106
107
 
# File 'secrets_manager/secret_target_attachment.rb', line 105

def stack()
  jsii_get_property("stack")
end

#to_string ⇒ String

Returns a string representation of this construct.

Returns:

  • (String) 


202
203
204
 
# File 'secrets_manager/secret_target_attachment.rb', line 202

def to_string()
  jsii_call_method("toString", [])
end

#with(*mixins) ⇒ Constructs::IConstruct

Applies one or more mixins to this construct.

Mixins are applied in order. The list of constructs is captured at the start of the call, so constructs added by a mixin will not be visited. Use multiple with() calls if subsequent mixins should apply to added constructs.

Parameters:

  • mixins (Array<Constructs::IMixin>)

Returns:

  • (Constructs::IConstruct) 


215
216
217
218
219
220
 
# File 'secrets_manager/secret_target_attachment.rb', line 215

def with(*mixins)
  mixins.each_with_index do |item, index|
    Jsii::Type.check_type(item, JSON.parse(Base64.strict_decode64("eyJmcW4iOiJjb25zdHJ1Y3RzLklNaXhpbiJ9")), "mixins[#{index}]")
  end
  jsii_call_method("with", [*mixins])
end