secretsmanager

package
v1.1.4 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jul 20, 2026 License: MIT Imports: 31 Imported by: 0

README

Secrets Manager

Parity grade: A · SDK aws-sdk-go-v2/service/secretsmanager@v1.42.5 · last audited 2026-07-11 (ff47d82c)

Coverage

Metric Value
Operations audited 24 (23 ok, 1 partial)
Feature families 3 (2 ok, 1 partial)
Known gaps 3
Deferred items 2
Resource leaks fixed
Known gaps
  • RotateSecret accepts rotation with no RotationLambdaARN ever configured on the secret or in the request (real AWS requires an existing rotation strategy or managed rotation) — kept as-is because dozens of existing tests rely on the lenient no-Lambda immediate-value-regen behavior as a test convenience, and gopherstack does not model AWS managed rotation at all (bd: gopherstack-qqq)
  • RotateSecret with RotateImmediately=false does not invoke the Lambda testSecret probe step or create/remove a transient AWSPENDING version (bd: gopherstack-avt) — re-confirmed 2026-07-11 against the live AWS API reference for RotateSecret, which explicitly documents this exact behavior ("Secrets Manager tests the rotation configuration by running the testSecret step... This test creates an AWSPENDING version of the secret and then removes it"), so the gap description is accurate and still open
  • DescribeSecretOutput/SecretListEntry expose a fabricated OwnerAccountId field not present in the real API (harmless — unknown JSON fields are ignored by real deserializers); managed-external-secret fields (ExternalSecretRotationMetadata/RoleArn, OwningService, Type) are entirely unmodeled, so the "owning-service" ListSecrets/BatchGetSecretValue filter always passes rather than matching a tracked owning service (bd: gopherstack-pct)
Deferred
  • Managed rotation (AWS-service-owned secrets, e.g. RDS-managed rotation) — out of scope, not modeled at all
  • Cross-account resource-policy principal evaluation beyond the wildcard-principal BlockPublicPolicy heuristic

More

Documentation

Overview

Package secretsmanager provides a mock AWS Secrets Manager implementation.

Index

Constants

View Source 
const (

	// MockAccountID is the mock AWS account ID.
	MockAccountID = config.DefaultAccountID
	// MockRegion is the mock AWS region.
	MockRegion = config.DefaultRegion
	// StagingLabelCurrent is the staging label for the current secret version.
	StagingLabelCurrent = "AWSCURRENT"
	// StagingLabelPrevious is the staging label for the previous secret version.
	StagingLabelPrevious = "AWSPREVIOUS"
)
View Source 
const DefaultKMSKeyAlias = "alias/aws/secretsmanager"

DefaultKMSKeyAlias is the key alias Secrets Manager encrypts a secret's values under when the secret does not specify KmsKeyId, mirroring real AWS's implicit account-level "aws/secretsmanager" managed key. Exported so cli.go's KMS adapter can recognise it and substitute a real backing key, since kms.InMemoryBackend.CreateAlias rejects the "alias/aws/" prefix (reserved for genuine AWS managed keys).

Variables

View Source 
var (
	// ErrSecretNotFound is returned when the specified secret does not exist.
	ErrSecretNotFound = errors.New(errResourceNotFoundException)

	// ErrMalformedPolicyDocument is returned when the resource policy is malformed.
	ErrMalformedPolicyDocument = errors.New("MalformedPolicyDocumentException")

	// ErrPublicPolicyException is returned when the policy is overly broad.
	ErrPublicPolicyException = errors.New("PublicPolicyException")

	// ErrSecretAlreadyExists is returned when a secret with the given name already exists.
	ErrSecretAlreadyExists = errors.New("ResourceExistsException")
	// ErrSecretDeleted is returned when an operation is attempted on a deleted secret.
	ErrSecretDeleted = errors.New("InvalidRequestException")
	// ErrVersionNotFound is returned when the specified version does not exist.
	ErrVersionNotFound = errors.New(errResourceNotFoundException)
	// ErrInvalidPasswordParameters is returned when password generation parameters are invalid
	// (e.g. PasswordLength out of range, or empty charset after exclusions, or too few positions
	// to satisfy RequireEachIncludedType).
	ErrInvalidPasswordParameters = errors.New("InvalidParameterException")
	// ErrCryptoRandInvalidRange is returned when cryptoRandInt is called with a non-positive bound.
	ErrCryptoRandInvalidRange = errors.New("random integer bound must be positive")
	// ErrSecretValueTooLarge is returned when a secret value exceeds the 64 KB AWS limit.
	ErrSecretValueTooLarge = errors.New("InvalidParameterException")
	// ErrInvalidParameter is returned when an invalid parameter value is provided.
	ErrInvalidParameter = errors.New("InvalidParameterException")
	// ErrInvalidSecretName is returned when a secret name does not match the allowed pattern.
	ErrInvalidSecretName = errors.New("InvalidParameterException")
)
View Source 
var (
	// ErrKMSEncryptionFailed wraps an error returned by the wired KMSEncryptor
	// while sealing a secret value.
	ErrKMSEncryptionFailed = errors.New("InvalidRequestException")
	// ErrKMSDecryptionFailed wraps an error returned by the wired KMSEncryptor
	// while opening a sealed secret value.
	ErrKMSDecryptionFailed = errors.New("InvalidRequestException")
	// ErrKMSNotConfigured is returned when a stored secret version was sealed
	// via KMS (Ciphertext is set) but no KMSEncryptor is currently wired to
	// decrypt it -- e.g. a snapshot was restored into a backend that never
	// called SetKMSEncryptor.
	ErrKMSNotConfigured = errors.New("InvalidRequestException: secret value was encrypted with KMS" +
		" but no KMS backend is wired")
)
View Source 
var ErrNilAppContext = errors.New("nil AppContext passed to SecretsManager Provider.Init")

ErrNilAppContext is returned when Init is called with a nil AppContext.

View Source 
var ErrUnknownOperation = errors.New("UnknownOperationException")

ErrUnknownOperation is returned when an unsupported operation is requested.

Functions

func UnixTimeFloat 

func UnixTimeFloat(t time.Time) float64

UnixTimeFloat converts a time value to a Unix timestamp float.

Types

type APIErrorType 

type APIErrorType struct {
	// ErrorCode is the AWS error type string.
	ErrorCode string `json:"ErrorCode"`
	// Message is the error message.
	Message string `json:"Message"`
	// SecretID is the identifier of the secret that caused the error.
	SecretID string `json:"SecretId"`
}

APIErrorType is an error entry returned by BatchGetSecretValue for a single secret.

type BatchGetSecretValueFilter 

type BatchGetSecretValueFilter struct {
	// Key is the filter key (e.g. "name", "tag-key", "tag-value", "description").
	Key string `json:"Key,omitempty"`
	// Values is the list of filter values.
	Values []string `json:"Values,omitempty"`
}

BatchGetSecretValueFilter is a filter for BatchGetSecretValue.

type BatchGetSecretValueInput 

type BatchGetSecretValueInput struct {
	// Filters specifies filter criteria for secrets to retrieve.
	Filters []BatchGetSecretValueFilter `json:"Filters,omitempty"`
	// MaxResults limits the number of results returned.
	MaxResults *int32 `json:"MaxResults,omitempty"`
	// NextToken is the pagination cursor from a previous call.
	NextToken string `json:"NextToken,omitempty"`
	// SecretIDList is the list of secret names or ARNs to retrieve.
	SecretIDList []string `json:"SecretIdList,omitempty"`
}

BatchGetSecretValueInput is the request payload for BatchGetSecretValue.

type BatchGetSecretValueOutput 

type BatchGetSecretValueOutput struct {
	// Errors contains per-secret errors.
	Errors []APIErrorType `json:"Errors,omitempty"`
	// NextToken is the pagination cursor for the next page.
	NextToken string `json:"NextToken,omitempty"`
	// SecretValues contains the successfully retrieved secret values.
	SecretValues []SecretValueEntry `json:"SecretValues"`
}

BatchGetSecretValueOutput is the response payload for BatchGetSecretValue.

type CancelRotateSecretInput 

type CancelRotateSecretInput struct {
	// SecretId is the name or ARN of the secret.
	SecretID string `json:"SecretId"`
}

CancelRotateSecretInput is the request payload for CancelRotateSecret.

type CancelRotateSecretOutput 

type CancelRotateSecretOutput struct {
	// ARN is the full ARN of the secret.
	ARN string `json:"ARN"`
	// Name is the name of the secret.
	Name string `json:"Name"`
	// VersionID is the version ID affected.
	VersionID string `json:"VersionId,omitempty"`
}

CancelRotateSecretOutput is the response payload for CancelRotateSecret.

type CreateSecretInput 

type CreateSecretInput struct {
	Name               string          `json:"Name"`
	Description        string          `json:"Description,omitempty"`
	SecretString       string          `json:"SecretString,omitempty"`
	ClientRequestToken string          `json:"ClientRequestToken,omitempty"`
	KmsKeyID           string          `json:"KmsKeyId,omitempty"`
	Region             string          `json:"-"`
	SecretBinary       []byte          `json:"SecretBinary,omitempty"`
	Tags               []Tag           `json:"Tags,omitempty"`
	AddReplicaRegions  []ReplicaRegion `json:"AddReplicaRegions,omitempty"`
}

CreateSecretInput is the request payload for CreateSecret.

type CreateSecretOutput 

type CreateSecretOutput struct {
	// ARN is the full ARN of the created secret.
	ARN string `json:"ARN"`
	// Name is the name of the created secret.
	Name string `json:"Name"`
	// VersionId is the initial version UUID.
	VersionID string `json:"VersionId,omitempty"`
	// ReplicationStatus is the initial replication status for AddReplicaRegions.
	ReplicationStatus []ReplicationStatusType `json:"ReplicationStatus,omitempty"`
}

CreateSecretOutput is the response payload for CreateSecret.

type DeleteResourcePolicyInput 

type DeleteResourcePolicyInput struct {
	// SecretId is the name or ARN of the secret.
	SecretID string `json:"SecretId"`
}

DeleteResourcePolicyInput is the request payload for DeleteResourcePolicy.

type DeleteResourcePolicyOutput 

type DeleteResourcePolicyOutput struct {
	// ARN is the full ARN of the secret.
	ARN string `json:"ARN"`
	// Name is the name of the secret.
	Name string `json:"Name"`
}

DeleteResourcePolicyOutput is the response payload for DeleteResourcePolicy.

type DeleteSecretInput 

type DeleteSecretInput struct {
	// RecoveryWindowInDays is the number of days before the secret can be deleted.
	// Must be between 7 and 30 inclusive. Defaults to 30 when not set.
	RecoveryWindowInDays *int64 `json:"RecoveryWindowInDays,omitempty"`
	// SecretId is the name or ARN of the secret to delete.
	SecretID string `json:"SecretId"`
	// ForceDeleteWithoutRecovery deletes immediately when true.
	ForceDeleteWithoutRecovery bool `json:"ForceDeleteWithoutRecovery,omitempty"`
}

DeleteSecretInput is the request payload for DeleteSecret.

type DeleteSecretOutput 

type DeleteSecretOutput struct {
	// ARN is the full ARN of the deleted secret.
	ARN string `json:"ARN"`
	// Name is the name of the deleted secret.
	Name string `json:"Name"`
	// DeletionDate is the Unix timestamp when the secret was deleted.
	DeletionDate float64 `json:"DeletionDate"`
}

DeleteSecretOutput is the response payload for DeleteSecret.

type DescribeSecretInput 

type DescribeSecretInput struct {
	// SecretId is the name or ARN of the secret.
	SecretID string `json:"SecretId"`
}

DescribeSecretInput is the request payload for DescribeSecret.

type DescribeSecretOutput 

type DescribeSecretOutput struct {
	Tags               *tags.Tags              `json:"Tags,omitempty"`
	DeletedDate        *float64                `json:"DeletedDate,omitempty"`
	CreatedDate        *float64                `json:"CreatedDate,omitempty"`
	LastChangedDate    *float64                `json:"LastChangedDate,omitempty"`
	LastRotatedDate    *float64                `json:"LastRotatedDate,omitempty"`
	LastAccessedDate   *float64                `json:"LastAccessedDate,omitempty"`
	NextRotationDate   *float64                `json:"NextRotationDate,omitempty"`
	VersionIDsToStages map[string][]string     `json:"VersionIdsToStages,omitempty"`
	ARN                string                  `json:"ARN"`
	Name               string                  `json:"Name"`
	Description        string                  `json:"Description,omitempty"`
	KmsKeyID           string                  `json:"KmsKeyId,omitempty"`
	RotationLambdaARN  string                  `json:"RotationLambdaARN,omitempty"`
	OwnerAccountID     string                  `json:"OwnerAccountId,omitempty"`
	PrimaryRegion      string                  `json:"PrimaryRegion,omitempty"`
	RotationRules      *RotationRulesType      `json:"RotationRules,omitempty"`
	ReplicationStatus  []ReplicationStatusType `json:"ReplicationStatus,omitempty"`
	RotationEnabled    bool                    `json:"RotationEnabled"`
}

DescribeSecretOutput is the response payload for DescribeSecret.

type ErrorResponse 

type ErrorResponse struct {
	// Type is the error type string.
	Type string `json:"__type"`
	// Message is the human-readable error message.
	Message string `json:"message"`
}

ErrorResponse is the Secrets Manager JSON error response format.

type GetRandomPasswordInput 

type GetRandomPasswordInput struct {
	PasswordLength          *int64 `json:"PasswordLength,omitempty"`
	ExcludeCharacters       string `json:"ExcludeCharacters,omitempty"`
	ExcludeNumbers          bool   `json:"ExcludeNumbers,omitempty"`
	ExcludePunctuation      bool   `json:"ExcludePunctuation,omitempty"`
	ExcludeUppercase        bool   `json:"ExcludeUppercase,omitempty"`
	ExcludeLowercase        bool   `json:"ExcludeLowercase,omitempty"`
	IncludeSpace            bool   `json:"IncludeSpace,omitempty"`
	RequireEachIncludedType bool   `json:"RequireEachIncludedType,omitempty"`
}

GetRandomPasswordInput is the request payload for GetRandomPassword.

type GetRandomPasswordOutput 

type GetRandomPasswordOutput struct {
	// RandomPassword is the generated password string.
	RandomPassword string `json:"RandomPassword"`
}

GetRandomPasswordOutput is the response payload for GetRandomPassword.

type GetResourcePolicyInput 

type GetResourcePolicyInput struct {
	// SecretId is the name or ARN of the secret.
	SecretID string `json:"SecretId"`
}

GetResourcePolicyInput is the request payload for GetResourcePolicy.

type GetResourcePolicyOutput 

type GetResourcePolicyOutput struct {
	// ARN is the full ARN of the secret.
	ARN string `json:"ARN"`
	// Name is the name of the secret.
	Name string `json:"Name"`
	// ResourcePolicy is the resource-based policy document.
	ResourcePolicy string `json:"ResourcePolicy,omitempty"`
}

GetResourcePolicyOutput is the response payload for GetResourcePolicy.

type GetSecretValueInput 

type GetSecretValueInput struct {
	// SecretId is the name or ARN of the secret.
	SecretID string `json:"SecretId"`
	// VersionId retrieves a specific version (default: AWSCURRENT).
	VersionID string `json:"VersionId,omitempty"`
	// VersionStage retrieves the version with this staging label (default: AWSCURRENT).
	VersionStage string `json:"VersionStage,omitempty"`
}

GetSecretValueInput is the request payload for GetSecretValue.

type GetSecretValueOutput 

type GetSecretValueOutput struct {
	// LastAccessedDate is the Unix timestamp (day granularity) of the most recent access.
	LastAccessedDate *float64 `json:"LastAccessedDate,omitempty"`
	// ARN is the full ARN of the secret.
	ARN string `json:"ARN"`
	// Name is the name of the secret.
	Name string `json:"Name"`
	// VersionId is the UUID of the version returned.
	VersionID string `json:"VersionId"`
	// SecretString is the string value (when the secret stores a string).
	SecretString string `json:"SecretString,omitempty"`
	// SecretBinary is the binary value (when the secret stores binary data).
	SecretBinary []byte `json:"SecretBinary,omitempty"`
	// VersionStages are the staging labels attached to this version.
	VersionStages []string `json:"VersionStages,omitempty"`
	// CreatedDate is the Unix timestamp when this version was created.
	CreatedDate float64 `json:"CreatedDate"`
}

GetSecretValueOutput is the response payload for GetSecretValue.

type Handler 

type Handler struct {
	Backend StorageBackend

	DefaultRegion string
	// contains filtered or unexported fields
}

Handler is the Echo HTTP handler for Secrets Manager operations.

func NewHandler 

func NewHandler(backend StorageBackend) *Handler

NewHandler creates a new Secrets Manager handler.

func (*Handler) ChaosOperations 

func (h *Handler) ChaosOperations() []string

ChaosOperations returns all operations that can be fault-injected.

func (*Handler) ChaosRegions 

func (h *Handler) ChaosRegions() []string

ChaosRegions returns all regions this Secrets Manager instance handles.

func (*Handler) ChaosServiceName 

func (h *Handler) ChaosServiceName() string

ChaosServiceName returns the lowercase AWS service name for fault rule matching.

func (*Handler) ExtractOperation 

func (h *Handler) ExtractOperation(c *echo.Context) string

ExtractOperation extracts the Secrets Manager operation name from the X-Amz-Target header.

func (*Handler) ExtractResource 

func (h *Handler) ExtractResource(c *echo.Context) string

ExtractResource returns the secret ID from the request body when present.

func (*Handler) GetSupportedOperations 

func (h *Handler) GetSupportedOperations() []string

GetSupportedOperations returns the list of supported Secrets Manager operations.

func (*Handler) Handler 

func (h *Handler) Handler() echo.HandlerFunc

Handler returns the Echo handler function for Secrets Manager operations.

func (*Handler) MatchPriority 

func (h *Handler) MatchPriority() int

MatchPriority returns the routing priority for the Secrets Manager handler.

func (*Handler) Name 

func (h *Handler) Name() string

Name returns the service name.

func (*Handler) Reset 

func (h *Handler) Reset()

Reset clears all in-memory state from the backend. It is used by the POST /_gopherstack/reset endpoint for CI pipelines and rapid local development.

func (*Handler) Restore 

func (h *Handler) Restore(ctx context.Context, data []byte) error

Restore implements persistence.Persistable by delegating to the backend.

func (*Handler) RouteMatcher 

func (h *Handler) RouteMatcher() service.Matcher

RouteMatcher returns a function that matches Secrets Manager requests by X-Amz-Target header.

func (*Handler) SetLambdaInvoker 

func (h *Handler) SetLambdaInvoker(invoker LambdaInvoker)

SetLambdaInvoker sets the Lambda invoker used for RotateSecret. It is stored on both the handler (for HTTP-triggered rotations) and the backend (for scheduled rotations triggered by the rotation scheduler goroutine).

func (*Handler) Shutdown 

func (h *Handler) Shutdown(ctx context.Context)

Shutdown stops the janitor worker and the rotation scheduler, waiting for the janitor to exit.

func (*Handler) Snapshot 

func (h *Handler) Snapshot(ctx context.Context) []byte

Snapshot implements persistence.Persistable by delegating to the backend.

func (*Handler) StartWorker 

func (h *Handler) StartWorker(ctx context.Context) error

StartWorker starts the background janitor if it is configured.

func (*Handler) WithJanitor 

func (h *Handler) WithJanitor(interval ...time.Duration) *Handler

WithJanitor attaches a background janitor to the handler.

type InMemoryBackend 

type InMemoryBackend struct {
	// contains filtered or unexported fields
}

InMemoryBackend is a concurrency-safe in-memory Secrets Manager backend. InMemoryBackend stores Secrets Manager state. secrets is isolated per region via a region-qualified composite key ("region|name") on a single flat store.Table, with a secondary index (secretsByRegion) grouping entries by region for per-region scans (ListSecrets, BatchGetSecretValue's filter path); see store_setup.go. resourcePolicies and replicationConfigs remain nested map[string]map[string]... (outer key = region) since their values (a bare string, a bare slice) carry no identity of their own to key a store.Table by -- see store_setup.go's doc comment for the full rationale.

func NewInMemoryBackend 

func NewInMemoryBackend() *InMemoryBackend

NewInMemoryBackend creates and returns a new empty Secrets Manager backend with default account/region.

func NewInMemoryBackendWithConfig 

func NewInMemoryBackendWithConfig(accountID, region string) *InMemoryBackend

NewInMemoryBackendWithConfig creates a new Secrets Manager backend with the given account ID and region and a background service context.

func NewInMemoryBackendWithContext 

func NewInMemoryBackendWithContext(svcCtx context.Context, accountID, region string) *InMemoryBackend

NewInMemoryBackendWithContext creates a new Secrets Manager backend whose background goroutines are bounded by svcCtx. If svcCtx is nil, context.Background is used.

func (*InMemoryBackend) AbortRotation 

func (b *InMemoryBackend) AbortRotation(ctx context.Context, secretID, versionID string) error

AbortRotation removes the AWSPENDING version, aborting an in-progress rotation. Called by the handler when a Lambda rotation step fails.

func (*InMemoryBackend) AccountID 

func (b *InMemoryBackend) AccountID() string

AccountID returns the AWS account ID configured for this backend.

func (*InMemoryBackend) AddSecretInternal 

func (b *InMemoryBackend) AddSecretInternal(s *Secret)

AddSecretInternal seeds the backend with a pre-built Secret for testing. The secret is placed in the region encoded in its ARN (falling back to the backend's default region). Must not be called concurrently with other operations.

func (*InMemoryBackend) BatchGetSecretValue 

func (b *InMemoryBackend) BatchGetSecretValue(
	ctx context.Context, input *BatchGetSecretValueInput,
) (*BatchGetSecretValueOutput, error)

BatchGetSecretValue retrieves the values of multiple secrets in a single call.

func (*InMemoryBackend) CancelRotateSecret 

func (b *InMemoryBackend) CancelRotateSecret(
	ctx context.Context, input *CancelRotateSecretInput,
) (*CancelRotateSecretOutput, error)

CancelRotateSecret cancels an in-progress rotation by removing the AWSPENDING staging label.

func (*InMemoryBackend) CreateSecret 

func (b *InMemoryBackend) CreateSecret(ctx context.Context, input *CreateSecretInput) (*CreateSecretOutput, error)

CreateSecret creates a new secret with an optional initial value.

func (*InMemoryBackend) DeleteResourcePolicy 

func (b *InMemoryBackend) DeleteResourcePolicy(
	ctx context.Context, input *DeleteResourcePolicyInput,
) (*DeleteResourcePolicyOutput, error)

DeleteResourcePolicy removes the resource-based policy from a secret.

func (*InMemoryBackend) DeleteSecret 

func (b *InMemoryBackend) DeleteSecret(ctx context.Context, input *DeleteSecretInput) (*DeleteSecretOutput, error)

DeleteSecret marks a secret as deleted, or permanently removes it when ForceDeleteWithoutRecovery is set.

func (*InMemoryBackend) DescribeSecret 

func (b *InMemoryBackend) DescribeSecret(
	ctx context.Context,
	input *DescribeSecretInput,
) (*DescribeSecretOutput, error)

DescribeSecret returns metadata about a secret.

func (*InMemoryBackend) FinishRotation 

func (b *InMemoryBackend) FinishRotation(ctx context.Context, secretID, versionID string) error

FinishRotation promotes the AWSPENDING version to AWSCURRENT. Called by the handler after all Lambda rotation steps succeed.

func (*InMemoryBackend) GetRandomPassword 

func (b *InMemoryBackend) GetRandomPassword(input *GetRandomPasswordInput) (*GetRandomPasswordOutput, error)

GetRandomPassword generates a cryptographically random password according to the given constraints.

func (*InMemoryBackend) GetResourcePolicy 

func (b *InMemoryBackend) GetResourcePolicy(
	ctx context.Context, input *GetResourcePolicyInput,
) (*GetResourcePolicyOutput, error)

GetResourcePolicy retrieves the resource-based policy for a secret.

func (*InMemoryBackend) GetSecretValue 

func (b *InMemoryBackend) GetSecretValue(
	ctx context.Context, input *GetSecretValueInput,
) (*GetSecretValueOutput, error)

GetSecretValue retrieves the value of a secret version.

func (*InMemoryBackend) ListAll 

func (b *InMemoryBackend) ListAll() []SecretListEntry

ListAll returns all secrets across all regions as list entries, sorted by name (for dashboard use).

func (*InMemoryBackend) ListSecretVersionIDs 

func (b *InMemoryBackend) ListSecretVersionIDs(
	ctx context.Context, input *ListSecretVersionIDsInput,
) (*ListSecretVersionIDsOutput, error)

ListSecretVersionIDs returns the list of versions for a secret with optional pagination.

func (*InMemoryBackend) ListSecrets 

func (b *InMemoryBackend) ListSecrets(ctx context.Context, input *ListSecretsInput) (*ListSecretsOutput, error)

ListSecrets returns a paginated list of secrets.

func (*InMemoryBackend) PutResourcePolicy 

func (b *InMemoryBackend) PutResourcePolicy(
	ctx context.Context, input *PutResourcePolicyInput,
) (*PutResourcePolicyOutput, error)

PutResourcePolicy stores a resource-based policy for a secret.

func (*InMemoryBackend) PutSecretValue 

func (b *InMemoryBackend) PutSecretValue(
	ctx context.Context, input *PutSecretValueInput,
) (*PutSecretValueOutput, error)

PutSecretValue adds a new version to an existing secret.

func (*InMemoryBackend) Region 

func (b *InMemoryBackend) Region() string

Region returns the AWS region configured for this backend.

func (*InMemoryBackend) RemoveRegionsFromReplication 

func (b *InMemoryBackend) RemoveRegionsFromReplication(
	ctx context.Context,
	input *RemoveRegionsFromReplicationInput,
) (*RemoveRegionsFromReplicationOutput, error)

RemoveRegionsFromReplication removes replication configuration for the specified regions.

func (*InMemoryBackend) ReplicateSecretToRegions 

func (b *InMemoryBackend) ReplicateSecretToRegions(
	ctx context.Context,
	input *ReplicateSecretToRegionsInput,
) (*ReplicateSecretToRegionsOutput, error)

ReplicateSecretToRegions adds replication configuration for the specified regions.

func (*InMemoryBackend) Reset 

func (b *InMemoryBackend) Reset()

Reset clears all in-memory state from the backend. It is used by the POST /_gopherstack/reset endpoint for CI pipelines and rapid local development.

func (*InMemoryBackend) Restore 

func (b *InMemoryBackend) Restore(ctx context.Context, data []byte) error

Restore loads backend state from a JSON snapshot. It implements persistence.Persistable.

func (*InMemoryBackend) RestoreSecret 

func (b *InMemoryBackend) RestoreSecret(ctx context.Context, input *RestoreSecretInput) (*RestoreSecretOutput, error)

RestoreSecret clears the deletion mark from a secret.

func (*InMemoryBackend) RotateSecret 

func (b *InMemoryBackend) RotateSecret(ctx context.Context, input *RotateSecretInput) (*RotateSecretOutput, error)

RotateSecret creates a new version of the secret (rotation stub).

func (*InMemoryBackend) SetKMSEncryptor 

func (b *InMemoryBackend) SetKMSEncryptor(e KMSEncryptor)

SetKMSEncryptor attaches e so that CreateSecret/PutSecretValue/UpdateSecret (and rotation) encrypt secret values via the real KMS backend, and GetSecretValue/BatchGetSecretValue decrypt them on read. Passing nil (the zero value) restores the default, backward-compatible behaviour: values are stored and returned exactly as given, with no encryption performed. A backend that never calls SetKMSEncryptor behaves identically to the pre-KMS-integration implementation.

func (*InMemoryBackend) SetLambdaInvoker 

func (b *InMemoryBackend) SetLambdaInvoker(invoker LambdaInvoker)

SetLambdaInvoker stores the Lambda invoker on the backend. The rotation scheduler uses it to invoke Lambda steps for scheduled rotations.

func (*InMemoryBackend) Snapshot 

func (b *InMemoryBackend) Snapshot(ctx context.Context) []byte

Snapshot serialises the backend state to JSON. It implements persistence.Persistable.

func (*InMemoryBackend) StopReplicationToReplica 

func (b *InMemoryBackend) StopReplicationToReplica(
	ctx context.Context,
	input *StopReplicationToReplicaInput,
) (*StopReplicationToReplicaOutput, error)

StopReplicationToReplica promotes a replica secret to a standalone secret.

func (*InMemoryBackend) StopRotationScheduler 

func (b *InMemoryBackend) StopRotationScheduler()

StopRotationScheduler signals the rotation scheduler goroutine to exit. It is idempotent and safe to call even if the scheduler was never started: closing the stop channel simply has no observer in that case.

func (*InMemoryBackend) TagResource 

func (b *InMemoryBackend) TagResource(ctx context.Context, input *TagResourceInput) error

TagResource adds or updates tags on a secret.

func (*InMemoryBackend) TagSecretByARN 

func (b *InMemoryBackend) TagSecretByARN(_ context.Context, secretARN string, newTags map[string]string) error

TagSecretByARN applies tags to the secret identified by its ARN. The region is taken from the ARN so cross-service callers (Resource Groups Tagging API) reach the right region.

func (*InMemoryBackend) TaggedSecrets 

func (b *InMemoryBackend) TaggedSecrets(_ context.Context) []TaggedSecretInfo

TaggedSecrets returns a snapshot of all secrets with their ARNs and tags. Intended for use by the Resource Groups Tagging API provider.

func (*InMemoryBackend) UntagResource 

func (b *InMemoryBackend) UntagResource(ctx context.Context, input *UntagResourceInput) error

UntagResource removes tags from a secret.

func (*InMemoryBackend) UntagSecretByARN 

func (b *InMemoryBackend) UntagSecretByARN(_ context.Context, secretARN string, tagKeys []string) error

UntagSecretByARN removes the specified tag keys from the secret identified by its ARN.

func (*InMemoryBackend) UpdateSecret 

func (b *InMemoryBackend) UpdateSecret(ctx context.Context, input *UpdateSecretInput) (*UpdateSecretOutput, error)

UpdateSecret updates the description of a secret and optionally creates a new version.

func (*InMemoryBackend) UpdateSecretVersionStage 

func (b *InMemoryBackend) UpdateSecretVersionStage(
	ctx context.Context,
	input *UpdateSecretVersionStageInput,
) (*UpdateSecretVersionStageOutput, error)

UpdateSecretVersionStage moves or adds a staging label to a specific secret version.

func (*InMemoryBackend) ValidateResourcePolicy 

func (b *InMemoryBackend) ValidateResourcePolicy(
	ctx context.Context,
	input *ValidateResourcePolicyInput,
) (*ValidateResourcePolicyOutput, error)

ValidateResourcePolicy validates a resource-based policy document for a secret. It performs basic structural validation and returns any detected issues.

type Janitor 

type Janitor struct {
	Backend     *InMemoryBackend
	Interval    time.Duration
	TaskTimeout time.Duration
}

Janitor is the Secrets Manager background worker that permanently deletes secrets past their recovery window.

func NewJanitor 

func NewJanitor(backend *InMemoryBackend, interval time.Duration) *Janitor

NewJanitor creates a new Secrets Manager Janitor for the given backend. A zero interval falls back to defaultSecretsManagerJanitorInterval.

func (*Janitor) Run 

func (j *Janitor) Run(ctx context.Context)

Run runs the janitor loop until ctx is cancelled.

func (*Janitor) SweepOnce 

func (j *Janitor) SweepOnce(ctx context.Context)

SweepOnce executes a single deletion sweep. Exposed for testing.

type KMSEncryptor 

type KMSEncryptor interface {
	// Encrypt encrypts plaintext under the given KMS key ID/ARN/alias and
	// returns the ciphertext blob to persist.
	Encrypt(ctx context.Context, keyID string, plaintext []byte) ([]byte, error)
	// Decrypt decrypts a ciphertext blob previously produced by Encrypt and
	// returns the original plaintext.
	Decrypt(ctx context.Context, ciphertext []byte) ([]byte, error)
}

KMSEncryptor provides symmetric encrypt/decrypt for secret values via the real KMS backend. It is implemented by an adapter wrapping kms.InMemoryBackend (see cli.go's secretsManagerKMSAdapter and wireSecretsManagerKMS), mirroring the ssm.KMSEncryptor precedent used to wire SSM SecureString parameters to KMS.

type LambdaInvoker 

type LambdaInvoker interface {
	InvokeFunction(ctx context.Context, name, invocationType string, payload []byte) ([]byte, int, error)
}

LambdaInvoker can invoke a Lambda function synchronously.

type ListSecretVersionIDsInput 

type ListSecretVersionIDsInput struct {
	MaxResults        *int64 `json:"MaxResults,omitempty"`
	SecretID          string `json:"SecretId"`
	NextToken         string `json:"NextToken,omitempty"`
	IncludeDeprecated bool   `json:"IncludeDeprecated,omitempty"`
}

ListSecretVersionIDsInput is the request payload for ListSecretVersionIDs.

type ListSecretVersionIDsOutput 

type ListSecretVersionIDsOutput struct {
	// ARN is the full ARN of the secret.
	ARN string `json:"ARN"`
	// Name is the name of the secret.
	Name string `json:"Name"`
	// NextToken is the pagination cursor for the next page.
	NextToken string `json:"NextToken,omitempty"`
	// Versions is the list of version entries.
	Versions []SecretVersionEntry `json:"Versions"`
}

ListSecretVersionIDsOutput is the response payload for ListSecretVersionIDs.

type ListSecretsInput 

type ListSecretsInput struct {
	MaxResults *int64 `json:"MaxResults,omitempty"`
	NextToken  string `json:"NextToken,omitempty"`
	SortOrder  string `json:"SortOrder,omitempty"` // "asc" or "desc"
	// SortBy selects the field secrets are ordered by: "name" (default),
	// "created-date", "last-changed-date", or "last-accessed-date".
	SortBy  string         `json:"SortBy,omitempty"`
	Filters []SecretFilter `json:"Filters,omitempty"`
	// IncludePlannedDeletion specifies whether to include secrets scheduled for
	// deletion. By default, secrets scheduled for deletion aren't included.
	// This is the real AWS wire field name (previously misnamed IncludeDeleted,
	// which real SDK clients never send, silently defeating the filter).
	IncludePlannedDeletion bool `json:"IncludePlannedDeletion,omitempty"`
}

ListSecretsInput is the request payload for ListSecrets.

type ListSecretsOutput 

type ListSecretsOutput struct {
	NextToken  string            `json:"NextToken,omitempty"`
	SecretList []SecretListEntry `json:"SecretList"`
}

ListSecretsOutput is the response payload for ListSecrets.

type PolicyValidationException 

type PolicyValidationException struct {
	// CheckName identifies the validation rule.
	CheckName string `json:"CheckName"`
	// ErrorMessage describes the issue.
	ErrorMessage string `json:"ErrorMessage"`
}

PolicyValidationException represents a single policy validation failure.

type Provider 

type Provider struct{}

Provider implements service.Provider for the Secrets Manager service.

func (*Provider) Init 

func (p *Provider) Init(ctx *service.AppContext) (service.Registerable, error)

Init initializes the Secrets Manager service backend and handler.

func (*Provider) Name 

func (p *Provider) Name() string

Name returns the logical name of the provider.

type PutResourcePolicyInput 

type PutResourcePolicyInput struct {
	BlockPublicPolicy *bool  `json:"BlockPublicPolicy,omitempty"`
	SecretID          string `json:"SecretId"`
	ResourcePolicy    string `json:"ResourcePolicy"`
}

PutResourcePolicyInput is the request payload for PutResourcePolicy.

type PutResourcePolicyOutput 

type PutResourcePolicyOutput struct {
	// ARN is the full ARN of the secret.
	ARN string `json:"ARN"`
	// Name is the name of the secret.
	Name string `json:"Name"`
}

PutResourcePolicyOutput is the response payload for PutResourcePolicy.

type PutSecretValueInput 

type PutSecretValueInput struct {
	SecretID           string `json:"SecretId"`
	SecretString       string `json:"SecretString,omitempty"`
	ClientRequestToken string `json:"ClientRequestToken,omitempty"`
	SecretBinary       []byte `json:"SecretBinary,omitempty"`
	// VersionStages are the staging labels to attach to the new version.
	// AWSCURRENT is always added; AWSPENDING is a common value during rotation.
	VersionStages []string `json:"VersionStages,omitempty"`
}

PutSecretValueInput is the request payload for PutSecretValue.

type PutSecretValueOutput 

type PutSecretValueOutput struct {
	// ARN is the full ARN of the secret.
	ARN string `json:"ARN"`
	// Name is the name of the secret.
	Name string `json:"Name"`
	// VersionId is the UUID of the new version.
	VersionID string `json:"VersionId"`
	// VersionStages are the staging labels attached to the new version.
	VersionStages []string `json:"VersionStages"`
}

PutSecretValueOutput is the response payload for PutSecretValue.

type RemoveRegionsFromReplicationInput 

type RemoveRegionsFromReplicationInput struct {
	// SecretId is the name or ARN of the secret.
	SecretID string `json:"SecretId"`
	// RemoveReplicaRegions is the list of regions to remove replicas from.
	RemoveReplicaRegions []string `json:"RemoveReplicaRegions"`
}

RemoveRegionsFromReplicationInput is the request payload for RemoveRegionsFromReplication.

type RemoveRegionsFromReplicationOutput 

type RemoveRegionsFromReplicationOutput struct {
	// ARN is the full ARN of the primary secret.
	ARN string `json:"ARN"`
	// ReplicationStatus contains the remaining replica statuses.
	ReplicationStatus []ReplicationStatusType `json:"ReplicationStatus"`
}

RemoveRegionsFromReplicationOutput is the response payload for RemoveRegionsFromReplication.

type ReplicaRegion 

type ReplicaRegion struct {
	// KmsKeyId is the ARN or alias of the KMS key to use for encryption.
	KmsKeyID string `json:"KmsKeyId,omitempty"`
	// Region is the AWS region to replicate to.
	Region string `json:"Region"`
}

ReplicaRegion specifies a target region and optional KMS key for secret replication.

type ReplicateSecretToRegionsInput 

type ReplicateSecretToRegionsInput struct {
	// SecretId is the name or ARN of the secret.
	SecretID string `json:"SecretId"`
	// AddReplicaRegions is the list of regions to replicate to.
	AddReplicaRegions []ReplicaRegion `json:"AddReplicaRegions"`
	// ForceOverwriteReplicaSecret controls whether to overwrite existing replicas.
	ForceOverwriteReplicaSecret bool `json:"ForceOverwriteReplicaSecret,omitempty"`
}

ReplicateSecretToRegionsInput is the request payload for ReplicateSecretToRegions.

type ReplicateSecretToRegionsOutput 

type ReplicateSecretToRegionsOutput struct {
	// ARN is the full ARN of the primary secret.
	ARN string `json:"ARN"`
	// ReplicationStatus contains the status for each replica region.
	ReplicationStatus []ReplicationStatusType `json:"ReplicationStatus"`
}

ReplicateSecretToRegionsOutput is the response payload for ReplicateSecretToRegions.

type ReplicationStatusType 

type ReplicationStatusType struct {
	// KmsKeyId is the ARN or alias of the KMS key used for encryption.
	KmsKeyID string `json:"KmsKeyId,omitempty"`
	// Region is the replica region.
	Region string `json:"Region,omitempty"`
	// Status is the replication status (e.g. "InSync", "Failed").
	Status string `json:"Status,omitempty"`
	// StatusMessage is an optional message describing the status.
	StatusMessage string `json:"StatusMessage,omitempty"`
}

ReplicationStatusType describes the replication status for a replica region.

type RestoreSecretInput 

type RestoreSecretInput struct {
	// SecretId is the name or ARN of the secret to restore.
	SecretID string `json:"SecretId"`
}

RestoreSecretInput is the request payload for RestoreSecret.

type RestoreSecretOutput 

type RestoreSecretOutput struct {
	// ARN is the full ARN of the restored secret.
	ARN string `json:"ARN"`
	// Name is the name of the restored secret.
	Name string `json:"Name"`
}

RestoreSecretOutput is the response payload for RestoreSecret.

type RotateSecretInput 

type RotateSecretInput struct {
	SecretID           string             `json:"SecretId"`
	RotationLambdaARN  string             `json:"RotationLambdaARN,omitempty"`
	RotationRules      *RotationRulesType `json:"RotationRules,omitempty"`
	RotateImmediately  *bool              `json:"RotateImmediately,omitempty"`
	ClientRequestToken string             `json:"ClientRequestToken,omitempty"`
}

RotateSecretInput is the request payload for RotateSecret.

type RotateSecretOutput 

type RotateSecretOutput struct {
	ARN       string `json:"ARN"`
	Name      string `json:"Name"`
	VersionID string `json:"VersionId,omitempty"`
}

RotateSecretOutput is the response payload for RotateSecret.

type RotationRulesType 

type RotationRulesType struct {
	// AutomaticallyAfterDays rotates the secret after this many days.
	AutomaticallyAfterDays *int64 `json:"AutomaticallyAfterDays,omitempty"`
	// Duration is an optional ISO-8601 duration window for rotation.
	Duration string `json:"Duration,omitempty"`
	// ScheduleExpression is an optional cron/rate expression for rotation scheduling.
	ScheduleExpression string `json:"ScheduleExpression,omitempty"`
}

RotationRulesType configures automatic secret rotation scheduling.

type Secret 

type Secret struct {

	// Tags is a map of key/value tag pairs.
	Tags *tags.Tags `json:"Tags,omitempty"`
	// DeletedDate is set when the secret is deleted; nil means active.
	DeletedDate *float64 `json:"DeletedDate,omitempty"`
	// ScheduledDeletionDate is the Unix timestamp when the janitor will permanently
	// purge this secret. Set at soft-delete time from the actual RecoveryWindowInDays.
	ScheduledDeletionDate *float64 `json:"ScheduledDeletionDate,omitempty"`
	// Versions holds all versions keyed by VersionId.
	Versions map[string]*SecretVersion `json:"-"`
	// LastChangedDate is the Unix timestamp of the most recent value change.
	LastChangedDate *float64 `json:"-"`
	// LastRotatedDate is the Unix timestamp of the most recent successful rotation.
	LastRotatedDate *float64 `json:"-"`
	// LastAccessedDate is the Unix timestamp of the most recent GetSecretValue call.
	LastAccessedDate *float64 `json:"-"`
	// CreatedDate is the Unix timestamp when this secret was created.
	CreatedDate *float64 `json:"-"`
	// ARN is the full ARN of the secret.
	ARN string `json:"ARN"`
	// Name is the human-readable name of the secret.
	Name string `json:"Name"`
	// Description is an optional human-readable description.
	Description string `json:"Description,omitempty"`
	// KmsKeyID is the ARN or alias of the KMS key used to encrypt the secret.
	KmsKeyID string `json:"-"`
	// RotationLambdaARN is the ARN of the Lambda used for rotation.
	RotationLambdaARN string `json:"-"`
	// RotationRules configures automatic secret rotation schedules.
	RotationRules *RotationRulesType `json:"-"`
	// CurrentVersionId is the VersionId with the AWSCURRENT label.
	CurrentVersionID string `json:"-"`
	// RotationEnabled is true after RotateSecret has been called at least once.
	RotationEnabled bool `json:"-"`
	// contains filtered or unexported fields
}

Secret represents a stored secret including all versions.

type SecretFilter 

type SecretFilter struct {
	// Key is the filter key (e.g. "name", "description", "tag-key", "tag-value", "all").
	Key string `json:"Key,omitempty"`
	// Values is the list of filter values.
	Values []string `json:"Values,omitempty"`
}

SecretFilter is a filter criterion for ListSecrets and BatchGetSecretValue.

type SecretListEntry 

type SecretListEntry struct {
	DeletedDate            *float64            `json:"DeletedDate,omitempty"`
	LastChangedDate        *float64            `json:"LastChangedDate,omitempty"`
	LastAccessedDate       *float64            `json:"LastAccessedDate,omitempty"`
	LastRotatedDate        *float64            `json:"LastRotatedDate,omitempty"`
	CreatedDate            *float64            `json:"CreatedDate,omitempty"`
	NextRotationDate       *float64            `json:"NextRotationDate,omitempty"`
	Tags                   *tags.Tags          `json:"Tags,omitempty"`
	RotationRules          *RotationRulesType  `json:"RotationRules,omitempty"`
	SecretVersionsToStages map[string][]string `json:"SecretVersionsToStages,omitempty"`
	ARN                    string              `json:"ARN"`
	Name                   string              `json:"Name"`
	Description            string              `json:"Description,omitempty"`
	KmsKeyID               string              `json:"KmsKeyId,omitempty"`
	RotationLambdaARN      string              `json:"RotationLambdaARN,omitempty"`
	RotationEnabled        bool                `json:"RotationEnabled,omitempty"`
}

SecretListEntry is a brief secret descriptor used in ListSecrets.

type SecretValueEntry 

type SecretValueEntry struct {
	// ARN is the full ARN of the secret.
	ARN string `json:"ARN"`
	// Name is the name of the secret.
	Name string `json:"Name"`
	// VersionID is the UUID of the version returned.
	VersionID string `json:"VersionId,omitempty"`
	// SecretString is the string value.
	SecretString string `json:"SecretString,omitempty"`
	// SecretBinary is the binary value.
	SecretBinary []byte `json:"SecretBinary,omitempty"`
	// VersionStages are the staging labels attached to this version.
	VersionStages []string `json:"VersionStages,omitempty"`
	// CreatedDate is the Unix timestamp when this version was created.
	CreatedDate float64 `json:"CreatedDate,omitempty"`
}

SecretValueEntry is a single secret value entry returned by BatchGetSecretValue.

type SecretVersion 

type SecretVersion struct {
	LastAccessedDate *float64 `json:"LastAccessedDate,omitempty"`
	VersionID        string   `json:"VersionId"`
	SecretString     string   `json:"SecretString,omitempty"`
	SecretBinary     []byte   `json:"SecretBinary,omitempty"`
	StagingLabels    []string `json:"VersionStages,omitempty"`
	KmsKeyIDs        []string `json:"KmsKeyIds,omitempty"`
	// Ciphertext, when non-nil, holds the KMS-encrypted secret value produced
	// by InMemoryBackend.sealVersion; SecretString and SecretBinary are then
	// both empty and the plaintext must be obtained via
	// InMemoryBackend.openVersion. Populated only when the backend has a
	// KMSEncryptor wired (see SetKMSEncryptor in kms.go) -- backends without
	// one continue to store SecretString/SecretBinary directly, exactly as
	// before KMS integration.
	Ciphertext []byte `json:"Ciphertext,omitempty"`
	// WasString records whether the plaintext sealed into Ciphertext came
	// from SecretString (true) or SecretBinary (false), so openVersion
	// restores it to the correct output field. Meaningless when Ciphertext
	// is nil.
	WasString   bool    `json:"WasStringValue,omitempty"`
	CreatedDate float64 `json:"CreatedDate"`
}

SecretVersion represents a single version of a secret.

type SecretVersionEntry 

type SecretVersionEntry struct {
	LastAccessedDate *float64 `json:"LastAccessedDate,omitempty"`
	VersionID        string   `json:"VersionId"`
	StagingLabels    []string `json:"VersionStages,omitempty"`
	KmsKeyIDs        []string `json:"KmsKeyIds,omitempty"`
	CreatedDate      float64  `json:"CreatedDate"`
}

SecretVersionEntry is a brief descriptor for a single secret version, used in ListSecretVersionIDs.

type StopReplicationToReplicaInput 

type StopReplicationToReplicaInput struct {
	// SecretId is the name or ARN of the secret replica to promote.
	SecretID string `json:"SecretId"`
}

StopReplicationToReplicaInput is the request payload for StopReplicationToReplica.

type StopReplicationToReplicaOutput 

type StopReplicationToReplicaOutput struct {
	// ARN is the full ARN of the promoted replica secret.
	ARN string `json:"ARN"`
}

StopReplicationToReplicaOutput is the response payload for StopReplicationToReplica.

type StorageBackend 

type StorageBackend interface {
	CreateSecret(ctx context.Context, input *CreateSecretInput) (*CreateSecretOutput, error)
	GetSecretValue(ctx context.Context, input *GetSecretValueInput) (*GetSecretValueOutput, error)
	PutSecretValue(ctx context.Context, input *PutSecretValueInput) (*PutSecretValueOutput, error)
	DeleteSecret(ctx context.Context, input *DeleteSecretInput) (*DeleteSecretOutput, error)
	ListSecrets(ctx context.Context, input *ListSecretsInput) (*ListSecretsOutput, error)
	ListSecretVersionIDs(ctx context.Context, input *ListSecretVersionIDsInput) (*ListSecretVersionIDsOutput, error)
	DescribeSecret(ctx context.Context, input *DescribeSecretInput) (*DescribeSecretOutput, error)
	UpdateSecret(ctx context.Context, input *UpdateSecretInput) (*UpdateSecretOutput, error)
	RestoreSecret(ctx context.Context, input *RestoreSecretInput) (*RestoreSecretOutput, error)
	TagResource(ctx context.Context, input *TagResourceInput) error
	UntagResource(ctx context.Context, input *UntagResourceInput) error
	RotateSecret(ctx context.Context, input *RotateSecretInput) (*RotateSecretOutput, error)
	GetRandomPassword(input *GetRandomPasswordInput) (*GetRandomPasswordOutput, error)
	ListAll() []SecretListEntry
	BatchGetSecretValue(ctx context.Context, input *BatchGetSecretValueInput) (*BatchGetSecretValueOutput, error)
	CancelRotateSecret(ctx context.Context, input *CancelRotateSecretInput) (*CancelRotateSecretOutput, error)
	GetResourcePolicy(ctx context.Context, input *GetResourcePolicyInput) (*GetResourcePolicyOutput, error)
	PutResourcePolicy(ctx context.Context, input *PutResourcePolicyInput) (*PutResourcePolicyOutput, error)
	DeleteResourcePolicy(ctx context.Context, input *DeleteResourcePolicyInput) (*DeleteResourcePolicyOutput, error)
	ReplicateSecretToRegions(
		ctx context.Context, input *ReplicateSecretToRegionsInput,
	) (*ReplicateSecretToRegionsOutput, error)
	RemoveRegionsFromReplication(
		ctx context.Context, input *RemoveRegionsFromReplicationInput,
	) (*RemoveRegionsFromReplicationOutput, error)
	StopReplicationToReplica(
		ctx context.Context, input *StopReplicationToReplicaInput,
	) (*StopReplicationToReplicaOutput, error)
	UpdateSecretVersionStage(
		ctx context.Context, input *UpdateSecretVersionStageInput,
	) (*UpdateSecretVersionStageOutput, error)
	ValidateResourcePolicy(
		ctx context.Context, input *ValidateResourcePolicyInput,
	) (*ValidateResourcePolicyOutput, error)
}

StorageBackend defines the interface for the Secrets Manager in-memory backend. The region for each operation is resolved from the supplied context (falling back to the backend's default region).

type Tag 

type Tag struct {
	// Key is the tag key.
	Key string `json:"Key"`
	// Value is the tag value.
	Value string `json:"Value"`
}

Tag represents a key/value tag pair in the Secrets Manager wire format.

type TagResourceInput 

type TagResourceInput struct {
	SecretID string `json:"SecretId"`
	Tags     []Tag  `json:"Tags"`
}

TagResourceInput is the request payload for TagResource.

type TaggedSecretInfo 

type TaggedSecretInfo struct {
	Tags map[string]string
	ARN  string
}

TaggedSecretInfo contains a secret's ARN and tag snapshot. Used by the Resource Groups Tagging API cross-service listing.

type UntagResourceInput 

type UntagResourceInput struct {
	SecretID string   `json:"SecretId"`
	TagKeys  []string `json:"TagKeys"`
}

UntagResourceInput is the request payload for UntagResource.

type UpdateSecretInput 

type UpdateSecretInput struct {
	SecretID           string `json:"SecretId"`
	Description        string `json:"Description,omitempty"`
	KmsKeyID           string `json:"KmsKeyId,omitempty"`
	SecretString       string `json:"SecretString,omitempty"`
	ClientRequestToken string `json:"ClientRequestToken,omitempty"`
	SecretBinary       []byte `json:"SecretBinary,omitempty"`
}

UpdateSecretInput is the request payload for UpdateSecret.

type UpdateSecretOutput 

type UpdateSecretOutput struct {
	// ARN is the full ARN of the updated secret.
	ARN string `json:"ARN"`
	// Name is the name of the updated secret.
	Name string `json:"Name"`
	// VersionId is the new version UUID when a value was also updated.
	VersionID string `json:"VersionId,omitempty"`
}

UpdateSecretOutput is the response payload for UpdateSecret.

type UpdateSecretVersionStageInput 

type UpdateSecretVersionStageInput struct {
	// SecretId is the name or ARN of the secret.
	SecretID string `json:"SecretId"`
	// VersionStage is the staging label to add or move.
	VersionStage string `json:"VersionStage"`
	// MoveToVersionID is the version to move the label to.
	MoveToVersionID string `json:"MoveToVersionId,omitempty"`
	// RemoveFromVersionID is the version to remove the label from.
	RemoveFromVersionID string `json:"RemoveFromVersionId,omitempty"`
}

UpdateSecretVersionStageInput is the request payload for UpdateSecretVersionStage.

type UpdateSecretVersionStageOutput 

type UpdateSecretVersionStageOutput struct {
	// ARN is the full ARN of the secret.
	ARN string `json:"ARN"`
	// Name is the name of the secret.
	Name string `json:"Name"`
}

UpdateSecretVersionStageOutput is the response payload for UpdateSecretVersionStage.

type ValidateResourcePolicyInput 

type ValidateResourcePolicyInput struct {
	// SecretId is the optional name or ARN of the secret to validate the policy against.
	SecretID string `json:"SecretId,omitempty"`
	// ResourcePolicy is the resource-based policy document to validate.
	ResourcePolicy string `json:"ResourcePolicy"`
}

ValidateResourcePolicyInput is the request payload for ValidateResourcePolicy.

type ValidateResourcePolicyOutput 

type ValidateResourcePolicyOutput struct {
	// ValidationErrors is the list of validation errors (empty when PolicyValidationPassed is true).
	ValidationErrors []PolicyValidationException `json:"ValidationErrors,omitempty"`
	// PolicyValidationPassed is true when no validation errors were found.
	PolicyValidationPassed bool `json:"PolicyValidationPassed"`
}

ValidateResourcePolicyOutput is the response payload for ValidateResourcePolicy.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.