Registry /
aws / aws-cdk-aws-secretsmanager
Install & Compatibility
Where this runs
tested against v1.204.0 · pip install
no network on importno background threads
Install × environment matrix
Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux
muslpy 3.10–3.920 runs
installs and imports cleanly · install 0.0s · import 0.000s · 57.6MB
glibcpy 3.10–3.920 runs
installs and imports cleanly · install 12.1s · import 0.000s · 58MB
170MB installed
● package 170MB
Code
Verified usage
Verified import paths — ran on the pinned version, not inferred.
Secret
✓ from aws_cdk import aws_secretsmanager
# or
from aws_cdk.aws_secretsmanager import Secret
✗ from aws_cdk import secretsmanager
In AWS CDK v1, service constructs modules are prefixed with `aws_` (e.g., `aws_secretsmanager`), not just the service name.
This quickstart demonstrates how to define a new secret using `aws-cdk.aws-secretsmanager`. It creates a secret with a generated random password, which is a common pattern for database credentials or API keys. Remember that sensitive values should not be hardcoded directly into your CDK code.
from aws_cdk import App, Stack, aws_secretsmanager as secretsmanager
from constructs import Construct
class MySecretsStack(Stack):
def __init__(self, scope: Construct, construct_id: str, **kwargs) -> None:
super().__init__(scope, construct_id, **kwargs)
# Define a new secret with a generated password
my_app_secret = secretsmanager.Secret(self, "MyAppSecret",
description="A secret for my application",
generate_secret_string=secretsmanager.SecretStringGenerator(
password_length=20,
exclude_characters='@/" '
)
)
# You can also define a secret with a specific value (e.g., loaded from env var)
# Note: Avoid hardcoding sensitive values directly
# my_static_secret = secretsmanager.Secret(self, "MyStaticSecret",
# secret_string="my-super-secret-value"
# )
# To reference the secret ARN, for example, for a policy or output
# print(f"Secret ARN: {my_app_secret.secret_arn}")
app = App()
MySecretsStack(app, "MySecretsStackExample")
app.synth()
Debug
Known issues
breakingAWS CDK v1 (`aws-cdk.aws-secretsmanager`) is a separate major version from AWS CDK v2 (`aws-cdk-lib`). V1 packages are not compatible with V2. New projects should generally start with V2.fixFor new projects, use `aws-cdk-lib` and its corresponding import paths (e.g., `from aws_cdk import aws_secretsmanager`). For existing v1 projects, refer to the AWS CDK migration guide for upgrading to v2.
affects: All v1.x.x versions when migrating to v2.x.x
gotchaRetrieving secret values in plaintext requires careful handling. `secret.secret_value` returns a token (e.g., `CfnDynamicReference`), not the actual plaintext value, during synthesis. To use the value, you often need `secret.secret_value.to_string()` for CloudFormation parameters, or you must retrieve it at application runtime.fixUse `secret.secret_value.to_string()` or `secret.secret_value.unsafe_unwrap()` when passing the value to other CloudFormation resources (e.g., environment variables for Lambda). For runtime retrieval, your application code (e.g., Lambda, EC2) must use the AWS SDK to fetch the secret's value by its ARN or name.
affects: All v1.x.x versions
gotchaConfiguring automatic secret rotation for services like RDS, Redshift, or DocumentDB requires a custom Lambda function and appropriate permissions, which need to be explicitly defined in your CDK stack. The `add_rotation_schedule` method helps but still relies on these underlying resources.fixEnsure the required Lambda function, IAM roles, and permissions are correctly set up and associated with the secret's rotation schedule. Refer to the AWS CDK documentation for specific service integration examples (e.g., `Secret.add_rotation_schedule()` and `RotationSchedule.add_target()`).
affects: All v1.x.x versions
Upgrade
Version history
1.204.0latest on PyPI · released Jun 19, 2023
Audit
Dependencies
aws-cdk.corerequiredRequired for all AWS CDK v1 applications to function as the core construct library.