Secrets Manager

4 resource kinds. Generated from the operator's CRD schemas.

API Group: aws.konfig.io/v1alpha1

Secret # GA

Secret is the Schema for managing AWS Secrets Manager Secrets.

kubectl get secrets · example on GitHub

Example

# Secret — Secrets Manager
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/secretsmanager.html#secret
apiVersion: aws.konfig.io/v1alpha1
kind: Secret
metadata:
  name: example-secret
  namespace: default
spec:
  description: Managed by konfig-konector
  forceDelete: false
  kmsKeyArn: arn:aws:iam::123456789012:role/example-role
  providerRef:
    name: example-secret
    region: us-east-1
  recoveryWindowInDays: 1
  secretName: example-secret
  secretStringRef:
    key: example
    name: example-secret
  tags:
    environment: dev
    team: platform

Spec

Field	Type	Required	Description
`description`	string	—	Description is a human-readable description.
`forceDelete`	boolean	—	ForceDelete permanently deletes the secret immediately with no recovery window.
`kmsKeyArn`	string	—	KMSKeyARN is the KMS key ARN for encrypting the secret.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`recoveryWindowInDays`	integer	—	RecoveryWindowInDays is the number of days before permanent deletion (7-30).
`secretName`	string	yes	SecretName is the name of the secret.
`secretStringRef`	object	—	SecretStringRef is a reference to a Kubernetes Secret containing the secret value.
`secretStringRef.key`	string	yes	Key is the key within the Secret whose value to use.
`secretStringRef.name`	string	yes	Name of the Kubernetes Secret.
`tags`	map<string>	—	Tags are AWS resource tags to apply.

Status

Field	Type	Required	Description
`arn`	string	—	ARN is the ARN of the secret.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`lastSyncTime`	string	—	LastSyncTime is when the resource was last successfully reconciled.
`observedGeneration`	integer	—	ObservedGeneration is the most recent .metadata.generation reconciled.

SecretRotation # GA

SecretRotation is the Schema for managing Secrets Manager rotation configuration.

kubectl get secretrotations · example on GitHub

Example

# SecretRotation — Secrets Manager
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/secretsmanager.html#secretrotation
apiVersion: aws.konfig.io/v1alpha1
kind: SecretRotation
metadata:
  name: example-secretrotation
  namespace: default
spec:
  automaticallyAfterDays: 1
  providerRef:
    name: example-secretrotation
    region: us-east-1
  rotationLambdaArn: arn:aws:iam::123456789012:role/example-role
  secretRef:
    name: example-secretrotation
    secretArn: arn:aws:iam::123456789012:role/example-role

Spec

Field	Type	Required	Description
`automaticallyAfterDays`	integer	yes	AutomaticallyAfterDays is the rotation interval in days.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`rotationLambdaArn`	string	yes	RotationLambdaARN is the ARN of the Lambda function that rotates the secret.
`secretRef`	object	yes	SecretRef references the secret to rotate.
`secretRef.name`	string	—	Name of a Secret CR in the same namespace.
`secretRef.secretArn`	string	—	SecretARN is a direct AWS Secrets Manager secret ARN or name.

Status

Field	Type	Required	Description
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`lastSyncTime`	string	—	LastSyncTime is when the resource was last successfully reconciled.
`observedGeneration`	integer	—	ObservedGeneration is the most recent .metadata.generation reconciled.
`rotationEnabled`	boolean	—	RotationEnabled indicates whether rotation is enabled.

SecretsManagerResourcePolicy # CLOUD CONTROL · AWS::SecretsManager::ResourcePolicy

SecretsManagerResourcePolicy manages AWS::SecretsManager::ResourcePolicy through the AWS Cloud Control API.

kubectl get secretsmanagerresourcepolicies · example on GitHub

Example

# SecretsManagerResourcePolicy — Secrets Manager
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/secretsmanager.html#secretsmanagerresourcepolicy
apiVersion: aws.konfig.io/v1alpha1
kind: SecretsManagerResourcePolicy
metadata:
  name: example-secretsmanagerresourcepolicy
  namespace: default
spec:
  blockPublicPolicy: false
  providerRef:
    name: example-secretsmanagerresourcepolicy
    region: us-east-1
  secretId: example-id

Spec

Field	Type	Required	Description
`blockPublicPolicy`	boolean	—	Specifies whether to block resource-based policies that allow broad access to the secret.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`resourcePolicy`	object	yes	A JSON-formatted string for an AWS resource-based policy.
`secretId`	string	yes	The ARN or name of the secret to attach the resource-based policy.

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`id`	string	—	The Arn of the secret.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.

SecretsManagerSecretTargetAttachment # CLOUD CONTROL · AWS::SecretsManager::SecretTargetAttachment

SecretsManagerSecretTargetAttachment manages AWS::SecretsManager::SecretTargetAttachment through the AWS Cloud Control API.

kubectl get secretsmanagersecrettargetattachments · example on GitHub

Example

# SecretsManagerSecretTargetAttachment — Secrets Manager
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/secretsmanager.html#secretsmanagersecrettargetattachment
apiVersion: aws.konfig.io/v1alpha1
kind: SecretsManagerSecretTargetAttachment
metadata:
  name: example-secretsmanagersecrettargetattachment
  namespace: default
spec:
  providerRef:
    name: example-secretsmanagersecrettargetattachment
    region: us-east-1
  secretId: example-id
  targetId: example-id
  targetType: example

Spec

Field	Type	Required	Description
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`secretId`	string	yes	Create-only in AWS: changing it requires replacing the resource.
`targetId`	string	yes
`targetType`	string	yes

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`id`	string	—	Read-only: reported by AWS after creation.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.