API version 2017-10-17 of the Amazon Secrets Manager SDK configuration.

You provided a resource-based policy with syntax errors.

You provided an invalid value for a parameter.

You provided a parameter value that is not valid for the current state of the resource.

Possible causes:

• You tried to perform the operation on a secret that's currently marked deleted.
• You tried to enable rotation on a secret that doesn't already have a Lambda function ARN configured and you didn't include such an ARN as a parameter in this call.

Secrets Manager can't decrypt the protected secret text using the provided KMS key.

The BlockPublicPolicy parameter is set to true and the resource policy did not prevent broad access to the secret.

Secrets Manager can't encrypt the protected secret text using the provided KMS key. Check that the customer master key (CMK) is available, enabled, and not in an invalid state. For more information, see How Key State Affects Use of a Customer Master Key.

The request failed because you did not complete all the prerequisite steps.

You provided an invalid NextToken value.

An error occurred on the server side.

A resource with the ID you requested already exists.

We can't find the resource that you asked for.

The request failed because it would exceed one of the Secrets Manager internal limits.

Allows you to add filters when you use the search function in Secrets Manager.

See: newFilter smart constructor.

Create a value of Filter with all optional fields omitted.

Use generic-lens or optics to modify other optional fields.

The following record fields are available, with the corresponding lenses provided for backwards compatibility:

$sel:values:Filter', filter_values - Filters your list of secrets by a specific value.

You can prefix your search value with an exclamation mark (!) in order to perform negation filters.

$sel:key:Filter', filter_key - Filters your list of secrets by a specific key.

Filters your list of secrets by a specific value.

You can prefix your search value with an exclamation mark (!) in order to perform negation filters.

Filters your list of secrets by a specific key.

(Optional) Custom type consisting of a Region (required) and the KmsKeyId which can be an ARN, Key ID, or Alias.

See: newReplicaRegionType smart constructor.

Create a value of ReplicaRegionType with all optional fields omitted.

Use generic-lens or optics to modify other optional fields.

The following record fields are available, with the corresponding lenses provided for backwards compatibility:

$sel:kmsKeyId:ReplicaRegionType', replicaRegionType_kmsKeyId - Can be an ARN, Key ID, or Alias.

$sel:region:ReplicaRegionType', replicaRegionType_region - Describes a single instance of Region objects.

Can be an ARN, Key ID, or Alias.

Describes a single instance of Region objects.

A replication object consisting of a RegionReplicationStatus object and includes a Region, KMSKeyId, status, and status message.

See: newReplicationStatusType smart constructor.

Create a value of ReplicationStatusType with all optional fields omitted.

Use generic-lens or optics to modify other optional fields.

The following record fields are available, with the corresponding lenses provided for backwards compatibility:

$sel:status:ReplicationStatusType', replicationStatusType_status - The status can be InProgress, Failed, or InSync.

$sel:kmsKeyId:ReplicationStatusType', replicationStatusType_kmsKeyId - Can be an ARN, Key ID, or Alias.

$sel:statusMessage:ReplicationStatusType', replicationStatusType_statusMessage - Status message such as "/Secret with this name already exists in this region/".

$sel:region:ReplicationStatusType', replicationStatusType_region - The Region where replication occurs.

$sel:lastAccessedDate:ReplicationStatusType', replicationStatusType_lastAccessedDate - The date that you last accessed the secret in the Region.

The status can be InProgress, Failed, or InSync.

Can be an ARN, Key ID, or Alias.

Status message such as "/Secret with this name already exists in this region/".

The Region where replication occurs.

The date that you last accessed the secret in the Region.

A structure that defines the rotation configuration for the secret.

See: newRotationRulesType smart constructor.

Create a value of RotationRulesType with all optional fields omitted.

Use generic-lens or optics to modify other optional fields.

The following record fields are available, with the corresponding lenses provided for backwards compatibility:

$sel:automaticallyAfterDays:RotationRulesType', rotationRulesType_automaticallyAfterDays - Specifies the number of days between automatic scheduled rotations of the secret.

Secrets Manager schedules the next rotation when the previous one is complete. Secrets Manager schedules the date by adding the rotation interval (number of days) to the actual date of the last rotation. The service chooses the hour within that 24-hour date window randomly. The minute is also chosen somewhat randomly, but weighted towards the top of the hour and influenced by a variety of factors that help distribute load.

Specifies the number of days between automatic scheduled rotations of the secret.

Secrets Manager schedules the next rotation when the previous one is complete. Secrets Manager schedules the date by adding the rotation interval (number of days) to the actual date of the last rotation. The service chooses the hour within that 24-hour date window randomly. The minute is also chosen somewhat randomly, but weighted towards the top of the hour and influenced by a variety of factors that help distribute load.

A structure that contains the details about a secret. It does not include the encrypted SecretString and SecretBinary values. To get those values, use the GetSecretValue operation.

See: newSecretListEntry smart constructor.

Create a value of SecretListEntry with all optional fields omitted.

Use generic-lens or optics to modify other optional fields.

The following record fields are available, with the corresponding lenses provided for backwards compatibility:

$sel:lastChangedDate:SecretListEntry', secretListEntry_lastChangedDate - The last date and time that this secret was modified in any way.

$sel:primaryRegion:SecretListEntry', secretListEntry_primaryRegion - The Region where Secrets Manager originated the secret.

$sel:arn:SecretListEntry', secretListEntry_arn - The Amazon Resource Name (ARN) of the secret.

For more information about ARNs in Secrets Manager, see Policy Resources in the Amazon Web Services Secrets Manager User Guide.

$sel:secretVersionsToStages:SecretListEntry', secretListEntry_secretVersionsToStages - A list of all of the currently assigned SecretVersionStage staging labels and the SecretVersionId attached to each one. Staging labels are used to keep track of the different versions during the rotation process.

A version that does not have any SecretVersionStage is considered deprecated and subject to deletion. Such versions are not included in this list.

$sel:rotationRules:SecretListEntry', secretListEntry_rotationRules - A structure that defines the rotation configuration for the secret.

$sel:deletedDate:SecretListEntry', secretListEntry_deletedDate - The date and time the deletion of the secret occurred. Not present on active secrets. The secret can be recovered until the number of days in the recovery window has passed, as specified in the RecoveryWindowInDays parameter of the DeleteSecret operation.

$sel:rotationEnabled:SecretListEntry', secretListEntry_rotationEnabled - Indicates whether automatic, scheduled rotation is enabled for this secret.

$sel:createdDate:SecretListEntry', secretListEntry_createdDate - The date and time when a secret was created.

$sel:kmsKeyId:SecretListEntry', secretListEntry_kmsKeyId - The ARN or alias of the Amazon Web Services KMS customer master key (CMK) used to encrypt the SecretString and SecretBinary fields in each version of the secret. If you don't provide a key, then Secrets Manager defaults to encrypting the secret fields with the default KMS CMK, the key named awssecretsmanager, for this account.

$sel:name:SecretListEntry', secretListEntry_name - The friendly name of the secret. You can use forward slashes in the name to represent a path hierarchy. For example, /prod/databases/dbserver1 could represent the secret for a server named dbserver1 in the folder databases in the folder prod.

$sel:owningService:SecretListEntry', secretListEntry_owningService - Returns the name of the service that created the secret.

$sel:lastRotatedDate:SecretListEntry', secretListEntry_lastRotatedDate - The most recent date and time that the Secrets Manager rotation process was successfully completed. This value is null if the secret hasn't ever rotated.

$sel:lastAccessedDate:SecretListEntry', secretListEntry_lastAccessedDate - The last date that this secret was accessed. This value is truncated to midnight of the date and therefore shows only the date, not the time.

$sel:description:SecretListEntry', secretListEntry_description - The user-provided description of the secret.

$sel:rotationLambdaARN:SecretListEntry', secretListEntry_rotationLambdaARN - The ARN of an Amazon Web Services Lambda function invoked by Secrets Manager to rotate and expire the secret either automatically per the schedule or manually by a call to RotateSecret.

$sel:tags:SecretListEntry', secretListEntry_tags - The list of user-defined tags associated with the secret. To add tags to a secret, use TagResource. To remove tags, use UntagResource.

The last date and time that this secret was modified in any way.

The Region where Secrets Manager originated the secret.

The Amazon Resource Name (ARN) of the secret.

For more information about ARNs in Secrets Manager, see Policy Resources in the Amazon Web Services Secrets Manager User Guide.

A list of all of the currently assigned SecretVersionStage staging labels and the SecretVersionId attached to each one. Staging labels are used to keep track of the different versions during the rotation process.

A version that does not have any SecretVersionStage is considered deprecated and subject to deletion. Such versions are not included in this list.

A structure that defines the rotation configuration for the secret.

The date and time the deletion of the secret occurred. Not present on active secrets. The secret can be recovered until the number of days in the recovery window has passed, as specified in the RecoveryWindowInDays parameter of the DeleteSecret operation.

Indicates whether automatic, scheduled rotation is enabled for this secret.

The date and time when a secret was created.

The ARN or alias of the Amazon Web Services KMS customer master key (CMK) used to encrypt the SecretString and SecretBinary fields in each version of the secret. If you don't provide a key, then Secrets Manager defaults to encrypting the secret fields with the default KMS CMK, the key named awssecretsmanager, for this account.

The friendly name of the secret. You can use forward slashes in the name to represent a path hierarchy. For example, /prod/databases/dbserver1 could represent the secret for a server named dbserver1 in the folder databases in the folder prod.

Returns the name of the service that created the secret.

The most recent date and time that the Secrets Manager rotation process was successfully completed. This value is null if the secret hasn't ever rotated.

The last date that this secret was accessed. This value is truncated to midnight of the date and therefore shows only the date, not the time.

The user-provided description of the secret.

The ARN of an Amazon Web Services Lambda function invoked by Secrets Manager to rotate and expire the secret either automatically per the schedule or manually by a call to RotateSecret.

The list of user-defined tags associated with the secret. To add tags to a secret, use TagResource. To remove tags, use UntagResource.

A structure that contains information about one version of a secret.

See: newSecretVersionsListEntry smart constructor.

Create a value of SecretVersionsListEntry with all optional fields omitted.

Use generic-lens or optics to modify other optional fields.

The following record fields are available, with the corresponding lenses provided for backwards compatibility:

$sel:versionId:SecretVersionsListEntry', secretVersionsListEntry_versionId - The unique version identifier of this version of the secret.

$sel:versionStages:SecretVersionsListEntry', secretVersionsListEntry_versionStages - An array of staging labels that are currently associated with this version of the secret.

$sel:createdDate:SecretVersionsListEntry', secretVersionsListEntry_createdDate - The date and time this version of the secret was created.

$sel:kmsKeyIds:SecretVersionsListEntry', secretVersionsListEntry_kmsKeyIds - The KMS keys used to encrypt the secret version.

$sel:lastAccessedDate:SecretVersionsListEntry', secretVersionsListEntry_lastAccessedDate - The date that this version of the secret was last accessed. Note that the resolution of this field is at the date level and does not include the time.

The unique version identifier of this version of the secret.

An array of staging labels that are currently associated with this version of the secret.

The date and time this version of the secret was created.

The KMS keys used to encrypt the secret version.

The date that this version of the secret was last accessed. Note that the resolution of this field is at the date level and does not include the time.

A structure that contains information about a tag.

See: newTag smart constructor.

Create a value of Tag with all optional fields omitted.

Use generic-lens or optics to modify other optional fields.

The following record fields are available, with the corresponding lenses provided for backwards compatibility:

$sel:value:Tag', tag_value - The string value associated with the key of the tag.

$sel:key:Tag', tag_key - The key identifier, or name, of the tag.

The string value associated with the key of the tag.

The key identifier, or name, of the tag.

Displays errors that occurred during validation of the resource policy.

See: newValidationErrorsEntry smart constructor.

Create a value of ValidationErrorsEntry with all optional fields omitted.

Use generic-lens or optics to modify other optional fields.

The following record fields are available, with the corresponding lenses provided for backwards compatibility:

$sel:checkName:ValidationErrorsEntry', validationErrorsEntry_checkName - Checks the name of the policy.

$sel:errorMessage:ValidationErrorsEntry', validationErrorsEntry_errorMessage - Displays error messages if validation encounters problems during validation of the resource policy.

Checks the name of the policy.

Displays error messages if validation encounters problems during validation of the resource policy.