API version 2017-10-17 of the Amazon Secrets Manager SDK configuration.

You provided a resource-based policy with syntax errors.

You provided an invalid value for a parameter.

You provided a parameter value that is not valid for the current state of the resource.

Possible causes:

• You tried to perform the operation on a secret that's currently marked deleted.
• You tried to enable rotation on a secret that doesn't already have a Lambda function ARN configured and you didn't include such an ARN as a parameter in this call.

Secrets Manager can't decrypt the protected secret text using the provided KMS key.

The BlockPublicPolicy parameter is set to true and the resource policy did not prevent broad access to the secret.

Secrets Manager can't encrypt the protected secret text using the provided KMS key. Check that the customer master key (CMK) is available, enabled, and not in an invalid state. For more information, see How Key State Affects Use of a Customer Master Key.

The request failed because you did not complete all the prerequisite steps.

You provided an invalid NextToken value.

An error occurred on the server side.

A resource with the ID you requested already exists.

We can't find the resource that you asked for.

The request failed because it would exceed one of the Secrets Manager internal limits.

See: newValidateResourcePolicy smart constructor.

Create a value of ValidateResourcePolicy with all optional fields omitted.

Use generic-lens or optics to modify other optional fields.

The following record fields are available, with the corresponding lenses provided for backwards compatibility:

$sel:secretId:ValidateResourcePolicy', validateResourcePolicy_secretId - (Optional) The identifier of the secret with the resource-based policy you want to validate. You can specify either the Amazon Resource Name (ARN) or the friendly name of the secret.

For an ARN, we recommend that you specify a complete ARN rather than a partial ARN.

$sel:resourcePolicy:ValidateResourcePolicy', validateResourcePolicy_resourcePolicy - A JSON-formatted string constructed according to the grammar and syntax for an Amazon Web Services resource-based policy. The policy in the string identifies who can access or manage this secret and its versions. For information on how to format a JSON parameter for the various command line tool environments, see Using JSON for Parameters in the CLI User Guide.publi

See: newValidateResourcePolicyResponse smart constructor.

Create a value of ValidateResourcePolicyResponse with all optional fields omitted.

Use generic-lens or optics to modify other optional fields.

The following record fields are available, with the corresponding lenses provided for backwards compatibility:

$sel:validationErrors:ValidateResourcePolicyResponse', validateResourcePolicyResponse_validationErrors - Returns an error message if your policy doesn't pass validatation.

$sel:policyValidationPassed:ValidateResourcePolicyResponse', validateResourcePolicyResponse_policyValidationPassed - Returns a message stating that your Reource Policy passed validation.

$sel:httpStatus:ValidateResourcePolicyResponse', validateResourcePolicyResponse_httpStatus - The response's http status code.

See: newDeleteSecret smart constructor.

Create a value of DeleteSecret with all optional fields omitted.

Use generic-lens or optics to modify other optional fields.

The following record fields are available, with the corresponding lenses provided for backwards compatibility:

$sel:recoveryWindowInDays:DeleteSecret', deleteSecret_recoveryWindowInDays - (Optional) Specifies the number of days that Secrets Manager waits before Secrets Manager can delete the secret. You can't use both this parameter and the ForceDeleteWithoutRecovery parameter in the same API call.

This value can range from 7 to 30 days with a default value of 30.

$sel:forceDeleteWithoutRecovery:DeleteSecret', deleteSecret_forceDeleteWithoutRecovery - (Optional) Specifies that the secret is to be deleted without any recovery window. You can't use both this parameter and the RecoveryWindowInDays parameter in the same API call.

An asynchronous background process performs the actual deletion, so there can be a short delay before the operation completes. If you write code to delete and then immediately recreate a secret with the same name, ensure that your code includes appropriate back off and retry logic.

Use this parameter with caution. This parameter causes the operation to skip the normal waiting period before the permanent deletion that Amazon Web Services would normally impose with the RecoveryWindowInDays parameter. If you delete a secret with the ForceDeleteWithouRecovery parameter, then you have no opportunity to recover the secret. You lose the secret permanently.

If you use this parameter and include a previously deleted or nonexistent secret, the operation does not return the error ResourceNotFoundException in order to correctly handle retries.

$sel:secretId:DeleteSecret', deleteSecret_secretId - Specifies the secret to delete. You can specify either the Amazon Resource Name (ARN) or the friendly name of the secret.

For an ARN, we recommend that you specify a complete ARN rather than a partial ARN.

See: newDeleteSecretResponse smart constructor.

Create a value of DeleteSecretResponse with all optional fields omitted.

Use generic-lens or optics to modify other optional fields.

The following record fields are available, with the corresponding lenses provided for backwards compatibility:

$sel:arn:DeleteSecretResponse', deleteSecretResponse_arn - The ARN of the secret that is now scheduled for deletion.

$sel:name:DeleteSecretResponse', deleteSecretResponse_name - The friendly name of the secret currently scheduled for deletion.

$sel:deletionDate:DeleteSecretResponse', deleteSecretResponse_deletionDate - The date and time after which this secret can be deleted by Secrets Manager and can no longer be restored. This value is the date and time of the delete request plus the number of days specified in RecoveryWindowInDays.

$sel:httpStatus:DeleteSecretResponse', deleteSecretResponse_httpStatus - The response's http status code.

See: newListSecrets smart constructor.

Create a value of ListSecrets with all optional fields omitted.

Use generic-lens or optics to modify other optional fields.

The following record fields are available, with the corresponding lenses provided for backwards compatibility:

$sel:filters:ListSecrets', listSecrets_filters - Lists the secret request filters.

$sel:nextToken:ListSecrets', listSecrets_nextToken - (Optional) Use this parameter in a request if you receive a NextToken response in a previous request indicating there's more output available. In a subsequent call, set it to the value of the previous call NextToken response to indicate where the output should continue from.

$sel:sortOrder:ListSecrets', listSecrets_sortOrder - Lists secrets in the requested order.

$sel:maxResults:ListSecrets', listSecrets_maxResults - (Optional) Limits the number of results you want to include in the response. If you don't include this parameter, it defaults to a value that's specific to the operation. If additional items exist beyond the maximum you specify, the NextToken response element is present and has a value (isn't null). Include that value as the NextToken request parameter in the next call to the operation to get the next part of the results. Note that Secrets Manager might return fewer results than the maximum even when there are more results available. You should check NextToken after every operation to ensure that you receive all of the results.

See: newListSecretsResponse smart constructor.

Create a value of ListSecretsResponse with all optional fields omitted.

Use generic-lens or optics to modify other optional fields.

The following record fields are available, with the corresponding lenses provided for backwards compatibility:

$sel:nextToken:ListSecrets', listSecretsResponse_nextToken - If present in the response, this value indicates that there's more output available than included in the current response. This can occur even when the response includes no values at all, such as when you ask for a filtered view of a very long list. Use this value in the NextToken request parameter in a subsequent call to the operation to continue processing and get the next part of the output. You should repeat this until the NextToken response element comes back empty (as null).

$sel:secretList:ListSecretsResponse', listSecretsResponse_secretList - A list of the secrets in the account.

$sel:httpStatus:ListSecretsResponse', listSecretsResponse_httpStatus - The response's http status code.

See: newUpdateSecret smart constructor.

Create a value of UpdateSecret with all optional fields omitted.

Use generic-lens or optics to modify other optional fields.

The following record fields are available, with the corresponding lenses provided for backwards compatibility:

$sel:secretBinary:UpdateSecret', updateSecret_secretBinary - (Optional) Specifies updated binary data that you want to encrypt and store in the new version of the secret. To use this parameter in the command-line tools, we recommend that you store your binary data in a file and then use the appropriate technique for your tool to pass the contents of the file as a parameter. Either SecretBinary or SecretString must have a value, but not both. They cannot both be empty.

This parameter is not accessible using the Secrets Manager console.-- -- Note: This Lens automatically encodes and decodes Base64 data. -- The underlying isomorphism will encode to Base64 representation during -- serialisation, and decode from Base64 representation during deserialisation. -- This Lens accepts and returns only raw unencoded data.

$sel:kmsKeyId:UpdateSecret', updateSecret_kmsKeyId - (Optional) Specifies an updated ARN or alias of the Amazon Web Services KMS customer master key (CMK) that Secrets Manager uses to encrypt the protected text in new versions of this secret as well as any existing versions of this secret that have the staging labels AWSCURRENT, AWSPENDING, or AWSPREVIOUS. For more information about staging labels, see Staging Labels in the Amazon Web Services Secrets Manager User Guide.

You can only use the account's default CMK to encrypt and decrypt if you call this operation using credentials from the same account that owns the secret. If the secret is in a different account, then you must create a custom CMK and provide the ARN of that CMK in this field. The user making the call must have permissions to both the secret and the CMK in their respective accounts.

$sel:secretString:UpdateSecret', updateSecret_secretString - (Optional) Specifies updated text data that you want to encrypt and store in this new version of the secret. Either SecretBinary or SecretString must have a value, but not both. They cannot both be empty.

If you create this secret by using the Secrets Manager console then Secrets Manager puts the protected secret text in only the SecretString parameter. The Secrets Manager console stores the information as a JSON structure of key/value pairs that the default Lambda rotation function knows how to parse.

For storing multiple values, we recommend that you use a JSON text string argument and specify key/value pairs. For more information, see Specifying parameter values for the Amazon Web Services CLI in the Amazon Web Services CLI User Guide.

$sel:clientRequestToken:UpdateSecret', updateSecret_clientRequestToken - (Optional) If you want to add a new version to the secret, this parameter specifies a unique identifier for the new version that helps ensure idempotency.

If you use the Amazon Web Services CLI or one of the Amazon Web Services SDK to call this operation, then you can leave this parameter empty. The CLI or SDK generates a random UUID for you and includes that in the request. If you don't use the SDK and instead generate a raw HTTP request to the Secrets Manager service endpoint, then you must generate a ClientRequestToken yourself for new versions and include that value in the request.

You typically only need to interact with this value if you implement your own retry logic and want to ensure that a given secret is not created twice. We recommend that you generate a UUID-type value to ensure uniqueness within the specified secret.

Secrets Manager uses this value to prevent the accidental creation of duplicate versions if there are failures and retries during the Lambda rotation function's processing.

• If the ClientRequestToken value isn't already associated with a version of the secret then a new version of the secret is created.
• If a version with this value already exists and that version's SecretString and SecretBinary values are the same as those in the request then the request is ignored (the operation is idempotent).
• If a version with this value already exists and that version's SecretString and SecretBinary values are different from the request then an error occurs because you cannot modify an existing secret value.

This value becomes the VersionId of the new version.

$sel:description:UpdateSecret', updateSecret_description - (Optional) Specifies an updated user-provided description of the secret.

$sel:secretId:UpdateSecret', updateSecret_secretId - Specifies the secret that you want to modify or to which you want to add a new version. You can specify either the Amazon Resource Name (ARN) or the friendly name of the secret.

For an ARN, we recommend that you specify a complete ARN rather than a partial ARN.

See: newUpdateSecretResponse smart constructor.

Create a value of UpdateSecretResponse with all optional fields omitted.

Use generic-lens or optics to modify other optional fields.

The following record fields are available, with the corresponding lenses provided for backwards compatibility:

$sel:versionId:UpdateSecretResponse', updateSecretResponse_versionId - If a new version of the secret was created by this operation, then VersionId contains the unique identifier of the new version.

$sel:arn:UpdateSecretResponse', updateSecretResponse_arn - The ARN of the secret that was updated.

Secrets Manager automatically adds several random characters to the name at the end of the ARN when you initially create a secret. This affects only the ARN and not the actual friendly name. This ensures that if you create a new secret with the same name as an old secret that you previously deleted, then users with access to the old secret don't automatically get access to the new secret because the ARNs are different.

$sel:name:UpdateSecretResponse', updateSecretResponse_name - The friendly name of the secret that was updated.

$sel:httpStatus:UpdateSecretResponse', updateSecretResponse_httpStatus - The response's http status code.

See: newRemoveRegionsFromReplication smart constructor.

Create a value of RemoveRegionsFromReplication with all optional fields omitted.

Use generic-lens or optics to modify other optional fields.

The following record fields are available, with the corresponding lenses provided for backwards compatibility:

$sel:secretId:RemoveRegionsFromReplication', removeRegionsFromReplication_secretId - Remove a secret by SecretId from replica Regions.

$sel:removeReplicaRegions:RemoveRegionsFromReplication', removeRegionsFromReplication_removeReplicaRegions - Remove replication from specific Regions.

See: newRemoveRegionsFromReplicationResponse smart constructor.

Create a value of RemoveRegionsFromReplicationResponse with all optional fields omitted.

Use generic-lens or optics to modify other optional fields.

The following record fields are available, with the corresponding lenses provided for backwards compatibility:

$sel:arn:RemoveRegionsFromReplicationResponse', removeRegionsFromReplicationResponse_arn - The secret ARN removed from replication regions.

$sel:replicationStatus:RemoveRegionsFromReplicationResponse', removeRegionsFromReplicationResponse_replicationStatus - Describes the remaining replication status after you remove regions from the replication list.

$sel:httpStatus:RemoveRegionsFromReplicationResponse', removeRegionsFromReplicationResponse_httpStatus - The response's http status code.

See: newRotateSecret smart constructor.

Create a value of RotateSecret with all optional fields omitted.

Use generic-lens or optics to modify other optional fields.

The following record fields are available, with the corresponding lenses provided for backwards compatibility:

$sel:rotationRules:RotateSecret', rotateSecret_rotationRules - A structure that defines the rotation configuration for this secret.

$sel:clientRequestToken:RotateSecret', rotateSecret_clientRequestToken - (Optional) Specifies a unique identifier for the new version of the secret that helps ensure idempotency.

If you use the Amazon Web Services CLI or one of the Amazon Web Services SDK to call this operation, then you can leave this parameter empty. The CLI or SDK generates a random UUID for you and includes that in the request for this parameter. If you don't use the SDK and instead generate a raw HTTP request to the Secrets Manager service endpoint, then you must generate a ClientRequestToken yourself for new versions and include that value in the request.

You only need to specify your own value if you implement your own retry logic and want to ensure that a given secret is not created twice. We recommend that you generate a UUID-type value to ensure uniqueness within the specified secret.

Secrets Manager uses this value to prevent the accidental creation of duplicate versions if there are failures and retries during the function's processing. This value becomes the VersionId of the new version.

$sel:rotationLambdaARN:RotateSecret', rotateSecret_rotationLambdaARN - (Optional) Specifies the ARN of the Lambda function that can rotate the secret.

$sel:secretId:RotateSecret', rotateSecret_secretId - Specifies the secret that you want to rotate. You can specify either the Amazon Resource Name (ARN) or the friendly name of the secret.

For an ARN, we recommend that you specify a complete ARN rather than a partial ARN.

See: newRotateSecretResponse smart constructor.

Create a value of RotateSecretResponse with all optional fields omitted.

Use generic-lens or optics to modify other optional fields.

The following record fields are available, with the corresponding lenses provided for backwards compatibility:

$sel:versionId:RotateSecretResponse', rotateSecretResponse_versionId - The ID of the new version of the secret created by the rotation started by this request.

$sel:arn:RotateSecretResponse', rotateSecretResponse_arn - The ARN of the secret.

$sel:name:RotateSecretResponse', rotateSecretResponse_name - The friendly name of the secret.

$sel:httpStatus:RotateSecretResponse', rotateSecretResponse_httpStatus - The response's http status code.

See: newCreateSecret smart constructor.

Create a value of CreateSecret with all optional fields omitted.

Use generic-lens or optics to modify other optional fields.

The following record fields are available, with the corresponding lenses provided for backwards compatibility:

$sel:addReplicaRegions:CreateSecret', createSecret_addReplicaRegions - (Optional) Add a list of regions to replicate secrets. Secrets Manager replicates the KMSKeyID objects to the list of regions specified in the parameter.

$sel:secretBinary:CreateSecret', createSecret_secretBinary - (Optional) Specifies binary data that you want to encrypt and store in the new version of the secret. To use this parameter in the command-line tools, we recommend that you store your binary data in a file and then use the appropriate technique for your tool to pass the contents of the file as a parameter.

Either SecretString or SecretBinary must have a value, but not both. They cannot both be empty.

This parameter is not available using the Secrets Manager console. It can be accessed only by using the Amazon Web Services CLI or one of the Amazon Web Services SDKs.-- -- Note: This Lens automatically encodes and decodes Base64 data. -- The underlying isomorphism will encode to Base64 representation during -- serialisation, and decode from Base64 representation during deserialisation. -- This Lens accepts and returns only raw unencoded data.

$sel:kmsKeyId:CreateSecret', createSecret_kmsKeyId - (Optional) Specifies the ARN, Key ID, or alias of the Amazon Web Services KMS customer master key (CMK) to be used to encrypt the SecretString or SecretBinary values in the versions stored in this secret.

You can specify any of the supported ways to identify a Amazon Web Services KMS key ID. If you need to reference a CMK in a different account, you can use only the key ARN or the alias ARN.

If you don't specify this value, then Secrets Manager defaults to using the Amazon Web Services account's default CMK (the one named aws/secretsmanager). If a Amazon Web Services KMS CMK with that name doesn't yet exist, then Secrets Manager creates it for you automatically the first time it needs to encrypt a version's SecretString or SecretBinary fields.

You can use the account default CMK to encrypt and decrypt only if you call this operation using credentials from the same account that owns the secret. If the secret resides in a different account, then you must create a custom CMK and specify the ARN in this field.

$sel:forceOverwriteReplicaSecret:CreateSecret', createSecret_forceOverwriteReplicaSecret - (Optional) If set, the replication overwrites a secret with the same name in the destination region.

$sel:secretString:CreateSecret', createSecret_secretString - (Optional) Specifies text data that you want to encrypt and store in this new version of the secret.

Either SecretString or SecretBinary must have a value, but not both. They cannot both be empty.

If you create a secret by using the Secrets Manager console then Secrets Manager puts the protected secret text in only the SecretString parameter. The Secrets Manager console stores the information as a JSON structure of key/value pairs that the Lambda rotation function knows how to parse.

For storing multiple values, we recommend that you use a JSON text string argument and specify key/value pairs. For more information, see Specifying parameter values for the Amazon Web Services CLI in the Amazon Web Services CLI User Guide.

$sel:clientRequestToken:CreateSecret', createSecret_clientRequestToken - (Optional) If you include SecretString or SecretBinary, then an initial version is created as part of the secret, and this parameter specifies a unique identifier for the new version.

If you use the Amazon Web Services CLI or one of the Amazon Web Services SDK to call this operation, then you can leave this parameter empty. The CLI or SDK generates a random UUID for you and includes it as the value for this parameter in the request. If you don't use the SDK and instead generate a raw HTTP request to the Secrets Manager service endpoint, then you must generate a ClientRequestToken yourself for the new version and include the value in the request.

This value helps ensure idempotency. Secrets Manager uses this value to prevent the accidental creation of duplicate versions if there are failures and retries during a rotation. We recommend that you generate a UUID-type value to ensure uniqueness of your versions within the specified secret.

• If the ClientRequestToken value isn't already associated with a version of the secret then a new version of the secret is created.
• If a version with this value already exists and the version SecretString and SecretBinary values are the same as those in the request, then the request is ignored.
• If a version with this value already exists and that version's SecretString and SecretBinary values are different from those in the request, then the request fails because you cannot modify an existing version. Instead, use PutSecretValue to create a new version.

This value becomes the VersionId of the new version.

$sel:description:CreateSecret', createSecret_description - (Optional) Specifies a user-provided description of the secret.

$sel:tags:CreateSecret', createSecret_tags - (Optional) Specifies a list of user-defined tags that are attached to the secret. Each tag is a "Key" and "Value" pair of strings. This operation only appends tags to the existing list of tags. To remove tags, you must use UntagResource.

• Secrets Manager tag key names are case sensitive. A tag with the key "ABC" is a different tag from one with key "abc".
• If you check tags in IAM policy Condition elements as part of your security strategy, then adding or removing a tag can change permissions. If the successful completion of this operation would result in you losing your permissions for this secret, then this operation is blocked and returns an Access Denied error.

This parameter requires a JSON text string argument. For information on how to format a JSON parameter for the various command line tool environments, see Using JSON for Parameters in the CLI User Guide. For example:

[{"Key":"CostCenter","Value":"12345"},{"Key":"environment","Value":"production"}]

If your command-line tool or SDK requires quotation marks around the parameter, you should use single quotes to avoid confusion with the double quotes required in the JSON text.

The following basic restrictions apply to tags:

• Maximum number of tags per secret—50
• Maximum key length—127 Unicode characters in UTF-8
• Maximum value length—255 Unicode characters in UTF-8
• Tag keys and values are case sensitive.
• Do not use the aws: prefix in your tag names or values because Amazon Web Services reserves it for Amazon Web Services use. You can't edit or delete tag names or values with this prefix. Tags with this prefix do not count against your tags per secret limit.
• If you use your tagging schema across multiple services and resources, remember other services might have restrictions on allowed characters. Generally allowed characters: letters, spaces, and numbers representable in UTF-8, plus the following special characters: + - = . _ : / @.

$sel:name:CreateSecret', createSecret_name - Specifies the friendly name of the new secret.

The secret name must be ASCII letters, digits, or the following characters : /_+=.@-

Do not end your secret name with a hyphen followed by six characters. If you do so, you risk confusion and unexpected results when searching for a secret by partial ARN. Secrets Manager automatically adds a hyphen and six random characters at the end of the ARN.

See: newCreateSecretResponse smart constructor.

Create a value of CreateSecretResponse with all optional fields omitted.

Use generic-lens or optics to modify other optional fields.

The following record fields are available, with the corresponding lenses provided for backwards compatibility:

$sel:versionId:CreateSecretResponse', createSecretResponse_versionId - The unique identifier associated with the version of the secret you just created.

$sel:arn:CreateSecretResponse', createSecretResponse_arn - The Amazon Resource Name (ARN) of the secret that you just created.

Secrets Manager automatically adds several random characters to the name at the end of the ARN when you initially create a secret. This affects only the ARN and not the actual friendly name. This ensures that if you create a new secret with the same name as an old secret that you previously deleted, then users with access to the old secret don't automatically get access to the new secret because the ARNs are different.

$sel:name:CreateSecret', createSecretResponse_name - The friendly name of the secret that you just created.

$sel:replicationStatus:CreateSecretResponse', createSecretResponse_replicationStatus - Describes a list of replication status objects as InProgress, Failed or InSync.

$sel:httpStatus:CreateSecretResponse', createSecretResponse_httpStatus - The response's http status code.

See: newGetSecretValue smart constructor.

Create a value of GetSecretValue with all optional fields omitted.

Use generic-lens or optics to modify other optional fields.

The following record fields are available, with the corresponding lenses provided for backwards compatibility:

$sel:versionId:GetSecretValue', getSecretValue_versionId - Specifies the unique identifier of the version of the secret that you want to retrieve. If you specify both this parameter and VersionStage, the two parameters must refer to the same secret version. If you don't specify either a VersionStage or VersionId then the default is to perform the operation on the version with the VersionStage value of AWSCURRENT.

This value is typically a UUID-type value with 32 hexadecimal digits.

$sel:versionStage:GetSecretValue', getSecretValue_versionStage - Specifies the secret version that you want to retrieve by the staging label attached to the version.

Staging labels are used to keep track of different versions during the rotation process. If you specify both this parameter and VersionId, the two parameters must refer to the same secret version . If you don't specify either a VersionStage or VersionId, then the default is to perform the operation on the version with the VersionStage value of AWSCURRENT.

$sel:secretId:GetSecretValue', getSecretValue_secretId - Specifies the secret containing the version that you want to retrieve. You can specify either the Amazon Resource Name (ARN) or the friendly name of the secret.

For an ARN, we recommend that you specify a complete ARN rather than a partial ARN.

See: newGetSecretValueResponse smart constructor.

Create a value of GetSecretValueResponse with all optional fields omitted.

Use generic-lens or optics to modify other optional fields.

The following record fields are available, with the corresponding lenses provided for backwards compatibility:

$sel:versionId:GetSecretValue', getSecretValueResponse_versionId - The unique identifier of this version of the secret.

$sel:arn:GetSecretValueResponse', getSecretValueResponse_arn - The ARN of the secret.

$sel:versionStages:GetSecretValueResponse', getSecretValueResponse_versionStages - A list of all of the staging labels currently attached to this version of the secret.

$sel:secretBinary:GetSecretValueResponse', getSecretValueResponse_secretBinary - The decrypted part of the protected secret information that was originally provided as binary data in the form of a byte array. The response parameter represents the binary data as a base64-encoded string.

This parameter is not used if the secret is created by the Secrets Manager console.

If you store custom information in this field of the secret, then you must code your Lambda rotation function to parse and interpret whatever you store in the SecretString or SecretBinary fields.-- -- Note: This Lens automatically encodes and decodes Base64 data. -- The underlying isomorphism will encode to Base64 representation during -- serialisation, and decode from Base64 representation during deserialisation. -- This Lens accepts and returns only raw unencoded data.

$sel:createdDate:GetSecretValueResponse', getSecretValueResponse_createdDate - The date and time that this version of the secret was created.

$sel:name:GetSecretValueResponse', getSecretValueResponse_name - The friendly name of the secret.

$sel:secretString:GetSecretValueResponse', getSecretValueResponse_secretString - The decrypted part of the protected secret information that was originally provided as a string.

If you create this secret by using the Secrets Manager console then only the SecretString parameter contains data. Secrets Manager stores the information as a JSON structure of key/value pairs that the Lambda rotation function knows how to parse.

If you store custom information in the secret by using the CreateSecret, UpdateSecret, or PutSecretValue API operations instead of the Secrets Manager console, or by using the Other secret type in the console, then you must code your Lambda rotation function to parse and interpret those values.

$sel:httpStatus:GetSecretValueResponse', getSecretValueResponse_httpStatus - The response's http status code.

See: newDescribeSecret smart constructor.