AWS Secrets Manager

Sync sends an environment's secrets to AWS Secrets Manager. Stashbase stays the source of truth: when a secret changes, Stashbase creates or updates it in AWS.

Set up

1. Connect your AWS account once per workspace, with an access key that has the permissions below.
2. Add the integration to an environment and choose the region, prefix, and tags.

Connect AWS

To connect, provide:

• Connection name: A name for the connection.
• AWS Access Key ID: The access key ID for your AWS account.
• AWS Secret Access Key: The secret access key for your AWS account.

Required permissions

The AWS credentials you use to connect Stashbase with AWS Secrets Manager need to have secretsmanager and sts:GetCallerIdentity permissions. Here is an example of an IAM policy that grants the necessary permissions:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "StashbaseSecretsManagerAccess",
      "Effect": "Allow",
      "Action": [
        "secretsmanager:CreateSecret",
        "secretsmanager:PutSecretValue",
        "secretsmanager:UpdateSecret",
        "secretsmanager:DescribeSecret",
        "secretsmanager:DeleteSecret",
        "secretsmanager:ListSecrets",
        "secretsmanager:TagResource",
        "secretsmanager:UntagResource",
        "secretsmanager:RestoreSecret"
      ],
      "Resource": "*"
    },
    {
      "Sid": "StashbaseValidation",
      "Effect": "Allow",
      "Action": "sts:GetCallerIdentity",
      "Resource": "*"
    }
  ]
}

Integration settings

Configure these settings when you add the integration to an environment.

Region

The AWS region where your secrets are stored.

Secret name prefix

Optional prefix to use for secret names in AWS Secrets Manager. This helps to organize secrets and avoid naming conflicts.

Tags

The tags to apply to secrets created or updated by Stashbase in AWS Secrets Manager. Tags are key-value pairs that help you organize and manage your secrets. You can add up to 10 custom tags in addition to the default tags that Stashbase applies to all secrets. Stashbase automatically adds and manages the following tags on secrets in AWS Secrets Manager:

• "managed-by": "stashbase"
• "stashbase-workspace-id": The ID of the Stashbase workspace that manages the secrets
• "stashbase-environment-id": The ID of the Stashbase environment that manages the secrets