Secrets Manager Secret

aws-secrets-manager

Secrets Manager secret with CMK-capable encryption, a TLS-only resource policy, optional cross-region replication, an optional initial version, and Lambda rotation scaffolding. Works with Terraform and OpenTofu (>= 1.6), AWS provider >= 6.0, < 7.0. The default posture creates no initial version — the value is managed out of band — and when you do seed a value the write-only path (secret_string_wo, Terraform 1.11+) keeps it out of state entirely.

Status: static-validated, live-test pending. Ships under live-test quarantine — validated with tofu fmt, tofu validate, and tflint. Real apply → read → destroy against an AWS account is pending a cloud sandbox. Live tests will set recovery_window_in_days = 0 for a clean (immediate, irrecoverable) destroy; production keeps the default 30-day recovery window. A standing secret costs ~$0.40/secret/month.

What you get:

• aws_secretsmanager_secret — CMK or AWS-managed encryption, recovery window, cross-region replicas.
• aws_secretsmanager_secret_version — optional initial version, with a state-stored (secret_string) or write-only (secret_string_wo) value.
• aws_secretsmanager_secret_policy — a generated TLS-only resource policy with block_public_policy on (override with a full policy JSON string).
• aws_secretsmanager_secret_rotation — opt-in Lambda rotation on a days or cron/rate schedule.

Secure defaults

• Always encrypted: AWS-managed aws/secretsmanager key by default; pass a CMK via kms_key_id (recommended for cross-account or replica access).
• Values kept out of state by default: no initial version is created (create_initial_version only seeds when you supply a value). When seeding, prefer secret_string_wo (Terraform 1.11+) so the plaintext never enters state; secret_string is the state-stored fallback and is marked sensitive.
• TLS-only resource policy denying any secretsmanager:* call over a non-TLS connection, with block_public_policy = true so a misconfigured policy can never make the secret world-readable. Cross-account read is off unless you name reader_principal_arns.
• 30-day recovery window by default — a deleted secret is recoverable; recovery_window_in_days = 0 (immediate, irrecoverable) is reserved for disposable test secrets.

Provider pin

aws = {
  source  = "hashicorp/aws"
  version = ">= 6.0, < 7.0"
}

License

Commercial — LicenseRef-IaCBazaar-Commercial. © IaC Bazaar. Original work (not derived from a third-party module).