Use AWS Secrets Manager to retrieve, create, update, list, describe, delete, restore, tag, untag, or rotate secrets. Configure AWS credentials with permission for the target region and secret.

Deletion and rotation affect credentials used by other systems. Review the selected operation's recovery window and rotation settings before running it. Secret values returned by these actions are available to later workflow steps; handle them as credentials.

Use the block

Retrieve, create, update, list, delete, describe, tag, untag, restore, and rotate secrets.

Actions

Secrets Manager Get Secret

Retrieve a secret value from AWS Secrets Manager

Inputs and outputs

Input

Parameter	Type	Required	Description
region	string	Yes	AWS region (e.g., us-east-1)
accessKeyId	string	Yes	AWS access key ID
secretAccessKey	string	Yes	AWS secret access key
secretId	string	Yes	The name or ARN of the secret to retrieve
versionId	string	No	The unique identifier of the version to retrieve
versionStage	string	No	The staging label of the version to retrieve (e.g., AWSCURRENT, AWSPREVIOUS)

Output

Parameter	Type	Description
name	string	Name of the secret
secretValue	string	The decrypted secret value
arn	string	ARN of the secret
versionId	string	Version ID of the secret
versionStages	array	Staging labels attached to this version
createdDate	string	Date the secret was created

Secrets Manager List Secrets

List secrets stored in AWS Secrets Manager

Inputs and outputs

Input

Parameter	Type	Required	Description
region	string	Yes	AWS region (e.g., us-east-1)
accessKeyId	string	Yes	AWS access key ID
secretAccessKey	string	Yes	AWS secret access key
maxResults	number	No	Maximum number of secrets to return (1-100, default 100)
nextToken	string	No	Pagination token from a previous request

Output

Parameter	Type	Description
secrets	json	List of secrets with name, ARN, description, dates, rotation rules/window, and version-to-stage mappings
nextToken	string	Pagination token for the next page of results
count	number	Number of secrets returned

Secrets Manager Create Secret

Create a new secret in AWS Secrets Manager

Inputs and outputs

Input

Parameter	Type	Required	Description
region	string	Yes	AWS region (e.g., us-east-1)
accessKeyId	string	Yes	AWS access key ID
secretAccessKey	string	Yes	AWS secret access key
name	string	Yes	Name of the secret to create
secretValue	string	Yes	The secret value (plain text or JSON string)
description	string	No	Description of the secret

Output

Parameter	Type	Description
message	string	Operation status message
name	string	Name of the created secret
arn	string	ARN of the created secret
versionId	string	Version ID of the created secret

Secrets Manager Update Secret

Update the value of an existing secret in AWS Secrets Manager

Inputs and outputs

Input

Parameter	Type	Required	Description
region	string	Yes	AWS region (e.g., us-east-1)
accessKeyId	string	Yes	AWS access key ID
secretAccessKey	string	Yes	AWS secret access key
secretId	string	Yes	The name or ARN of the secret to update
secretValue	string	Yes	The new secret value (plain text or JSON string)
description	string	No	Updated description of the secret

Output

Parameter	Type	Description
message	string	Operation status message
name	string	Name of the updated secret
arn	string	ARN of the updated secret
versionId	string	Version ID of the updated secret

Secrets Manager Delete Secret

Delete a secret from AWS Secrets Manager

Inputs and outputs

Input

Parameter	Type	Required	Description
region	string	Yes	AWS region (e.g., us-east-1)
accessKeyId	string	Yes	AWS access key ID
secretAccessKey	string	Yes	AWS secret access key
secretId	string	Yes	The name or ARN of the secret to delete
recoveryWindowInDays	number	No	Number of days before permanent deletion (7-30, default 30)
forceDelete	boolean	No	If true, immediately delete without recovery window

Output

Parameter	Type	Description
message	string	Operation status message
name	string	Name of the deleted secret
arn	string	ARN of the deleted secret
deletionDate	string	Scheduled deletion date

Secrets Manager Describe Secret

Retrieve full metadata for a secret in AWS Secrets Manager, including rotation configuration and replication status, without exposing the secret value

Inputs and outputs

Input

Parameter	Type	Required	Description
region	string	Yes	AWS region (e.g., us-east-1)
accessKeyId	string	Yes	AWS access key ID
secretAccessKey	string	Yes	AWS secret access key
secretId	string	Yes	The name or ARN of the secret to describe

Output

Parameter	Type	Description
name	string	Name of the secret
arn	string	ARN of the secret
description	string	Description of the secret
kmsKeyId	string	KMS key ID used to encrypt the secret
rotationEnabled	boolean	Whether automatic rotation is enabled
rotationLambdaARN	string	ARN of the Lambda function used for rotation
rotationRules	json	Rotation schedule configuration
lastRotatedDate	string	Date the secret was last rotated
lastChangedDate	string	Date the secret was last changed
lastAccessedDate	string	Date the secret was last accessed
deletedDate	string	Scheduled deletion date
nextRotationDate	string	Date the secret is next scheduled to rotate
tags	array	Tags attached to the secret
versionIdsToStages	json	Map of version IDs to their staging labels
owningService	string	ID of the AWS service that manages this secret, if any
createdDate	string	Date the secret was created
primaryRegion	string	The primary region of the secret, if replicated
replicationStatus	array	Replication status for each region the secret is replicated to

Secrets Manager Tag Resource

Attach tags to a secret in AWS Secrets Manager

Inputs and outputs

Input

Parameter	Type	Required	Description
region	string	Yes	AWS region (e.g., us-east-1)
accessKeyId	string	Yes	AWS access key ID
secretAccessKey	string	Yes	AWS secret access key
secretId	string	Yes	The name or ARN of the secret to tag
tags	json	Yes	Tags to attach, as an array of {key, value} pairs (max 50)

Output

Parameter	Type	Description
message	string	Operation status message
name	string	Name or ARN of the tagged secret

Secrets Manager Untag Resource

Remove tags from a secret in AWS Secrets Manager

Inputs and outputs

Input

Parameter	Type	Required	Description
region	string	Yes	AWS region (e.g., us-east-1)
accessKeyId	string	Yes	AWS access key ID
secretAccessKey	string	Yes	AWS secret access key
secretId	string	Yes	The name or ARN of the secret to untag
tagKeys	json	Yes	Tag keys to remove, as an array of strings (max 50)

Output

Parameter	Type	Description
message	string	Operation status message
name	string	Name or ARN of the untagged secret

Secrets Manager Restore Secret

Cancel a scheduled deletion for a secret in AWS Secrets Manager, restoring access to it

Inputs and outputs

Input

Parameter	Type	Required	Description
region	string	Yes	AWS region (e.g., us-east-1)
accessKeyId	string	Yes	AWS access key ID
secretAccessKey	string	Yes	AWS secret access key
secretId	string	Yes	The name or ARN of the secret to restore

Output

Parameter	Type	Description
message	string	Operation status message
name	string	Name of the restored secret
arn	string	ARN of the restored secret

Secrets Manager Rotate Secret

Start or reconfigure rotation for a secret in AWS Secrets Manager

Inputs and outputs

Input

Parameter	Type	Required	Description
region	string	Yes	AWS region (e.g., us-east-1)
accessKeyId	string	Yes	AWS access key ID
secretAccessKey	string	Yes	AWS secret access key
secretId	string	Yes	The name or ARN of the secret to rotate
clientRequestToken	string	No	Idempotency token for the new secret version (32-64 characters)
rotationLambdaARN	string	No	ARN of the Lambda function that performs rotation (omit for managed rotation)
automaticallyAfterDays	number	No	Number of days between rotations (1-1000). Mutually exclusive with schedule expression
duration	string	No	Length of the rotation window in hours, e.g. "3h"
scheduleExpression	string	No	A cron() or rate() expression defining the rotation schedule
rotateImmediately	boolean	No	Whether to rotate immediately (default true) or wait for the next scheduled window

Output

Parameter	Type	Description
message	string	Operation status message
name	string	Name of the secret
arn	string	ARN of the secret
versionId	string	ID of the new secret version created by rotation