secrets-manager

Creates AWS Secrets Manager secrets with rotation, resource policies, and cross-region replication.

Provisions any number of secrets, optionally seeds them with an initial value (change-ignored after first apply), attaches resource-based policies for cross-account access, enables automatic rotation via a caller-supplied Lambda, and replicates to additional regions. KMS encryption is applied per secret using the security/kms module's key ARN.

Usage

module "secrets" {
  source  = "hcassc.jfrog.io/iac-terraform-modules-virtual/security/secrets-manager/aws"
  version = "0.1.0"

  secrets = {
    db_password = {
      name       = "/prod/rds/password"
      kms_key_id = module.kms.key_arn
      rotation = {
        lambda_arn    = module.rotation_lambda.arn
        rotation_days = 30
      }
    }
  }
}

Requirements

Name	Version
terraform	~> 1.5
aws	~> 6.50

Providers

Name	Version
aws	6.50.0

Resources

Name	Type
aws_secretsmanager_secret.this	resource
aws_secretsmanager_secret_policy.this	resource
aws_secretsmanager_secret_rotation.this	resource
aws_secretsmanager_secret_version.this	resource

Inputs

Name	Description	Type	Default	Required
secrets	Map of secrets to create. secret_string and secret_binary are mutuallyexclusive. Leave both null to create a secret without an initial value.	map(object({ name = string description = optional(string, "") kms_key_id = optional(string, null) recovery_window_in_days = optional(number, 30) secret_string = optional(string, null) resource_policy = optional(string, null) replica_regions = optional(list(string), []) rotation = optional(object({ lambda_arn = string rotation_days = optional(number, 30) rotate_immediately = optional(bool, true) }), null) }))	{}	no
tags	Resource tags to apply to all resources	map(string)	{}	no

Outputs

Name	Description
secret_arns	Map of logical key to secret ARN
secret_ids	Map of logical key to secret ID
secret_names	Map of logical key to secret name