getSecrets

AWS v7.50.0, Oct 8 26

Viewing docs for AWS v7.50.0
published on Thursday, Oct 8, 2026 by Pulumi

Schema (JSON)

pulumi/pulumi-aws

Viewing docs for AWS v7.50.0
published on Thursday, Oct 8, 2026 by Pulumi

Schema (JSON)

pulumi/pulumi-aws

Example Usage

If you do not already have a CiphertextBlob from encrypting a KMS secret, you can use the below commands to obtain one using the AWS CLI kms encrypt command. This requires you to have your AWS CLI setup correctly and replace the --key-id with your own. Alternatively you can use --plaintext 'master-password' (CLIv1) or --plaintext fileb://<(echo -n 'master-password') (CLIv2) instead of reading from a file.

If you have a newline character at the end of your file, it will be decrypted with this newline character intact. For most use cases this is undesirable and leads to incorrect passwords or invalid values, as well as possible changes in the plan. Be sure to use echo -n if necessary. If you are using asymmetric keys ensure you are using the right encryption algorithm when you encrypt and decrypt else you will get IncorrectKeyException during the decrypt phase.

% echo -n 'master-password' > plaintext-password
% aws kms encrypt --key-id ab123456-c012-4567-890a-deadbeef123 --plaintext fileb://plaintext-password --encryption-context foo=bar --output text --query CiphertextBlob
AQECAHgaPa0J8WadplGCqqVAr4HNvDaFSQ+NaiwIBhmm6qDSFwAAAGIwYAYJKoZIhvcNAQcGoFMwUQIBADBMBgkqhkiG9w0BBwEwHgYJYIZIAWUDBAEuMBEEDI+LoLdvYv8l41OhAAIBEIAfx49FFJCLeYrkfMfAw6XlnxP23MmDBdqP8dPp28OoAQ==
% aws kms encrypt --key-id ab123456-c012-4567-890a-deadbeef123 --plaintext fileb://plaintext-password --encryption-algorithm RSAES_OAEP_SHA_256 --output text --query CiphertextBlob
AQECAHgaPa0J8WadplGCqqVAr4HNvDaFSQ+NaiwIBhmm6qDSFwAAAGIwYAYJKoZIhvcNAQcGoFMwUQIBADBMBgkqhkiG9w0BBwEwHgYJYIZIAWUDBAEuMBEEDI+LoLdvYv8l41OhAAIBEIAfx49FFJCLeYrkfMfAw6XlnxP23MmDBdqP8dPp28OoAQ==

That encrypted output can now be inserted into provider configurations without exposing the plaintext secret directly.

Using getSecrets

Two invocation forms are available. The direct form accepts plain arguments and either blocks until the result value is available, or returns a Promise-wrapped result. The output form accepts Input-wrapped arguments and returns an Output-wrapped result.

function getSecrets(args: GetSecretsArgs, opts?: InvokeOptions): Promise<GetSecretsResult>
function getSecretsOutput(args: GetSecretsOutputArgs, opts?: InvokeOutputOptions): Output<GetSecretsResult>

def get_secrets(region: Optional[str] = None,
                secrets: Optional[Sequence[GetSecretsSecret]] = None,
                opts: Optional[InvokeOptions] = None) -> GetSecretsResult
def get_secrets_output(region: pulumi.Input[Optional[str]] = None,
                secrets: pulumi.Input[Optional[Sequence[pulumi.Input[GetSecretsSecretArgs]]]] = None,
                opts: Optional[InvokeOutputOptions] = None) -> Output[GetSecretsResult]

func GetSecrets(ctx *Context, args *GetSecretsArgs, opts ...InvokeOption) (*GetSecretsResult, error)
func GetSecretsOutput(ctx *Context, args *GetSecretsOutputArgs, opts ...InvokeOption) GetSecretsResultOutput

> Note: This function is named GetSecrets in the Go SDK.

public static class GetSecrets 
{
    public static Task<GetSecretsResult> InvokeAsync(GetSecretsArgs args, InvokeOptions? opts = null)
    public static Output<GetSecretsResult> Invoke(GetSecretsInvokeArgs args, InvokeOptions? opts = null)
    public static Output<GetSecretsResult> Invoke(GetSecretsInvokeArgs args, InvokeOutputOptions opts)
}

public static CompletableFuture<GetSecretsResult> getSecrets(GetSecretsArgs args, InvokeOptions options)
public static Output<GetSecretsResult> getSecrets(GetSecretsArgs args, InvokeOptions options)
public static Output<GetSecretsResult> getSecrets(GetSecretsArgs args, InvokeOutputOptions options)

fn::invoke:
  function: aws:kms/getSecrets:getSecrets
  arguments:
    # arguments dictionary

data "aws_kms_get_secrets" "name" {
    # arguments
}

The following arguments are supported:

Secrets List<GetSecretsSecret>: One or more encrypted payload definitions from the KMS service. See secret below.
Region string: Region where this resource will be managed. Defaults to the Region set in the provider configuration.

Secrets []GetSecretsSecret: One or more encrypted payload definitions from the KMS service. See secret below.
Region string: Region where this resource will be managed. Defaults to the Region set in the provider configuration.

secrets list(object): One or more encrypted payload definitions from the KMS service. See secret below.
region string: Region where this resource will be managed. Defaults to the Region set in the provider configuration.

secrets List<GetSecretsSecret>: One or more encrypted payload definitions from the KMS service. See secret below.
region String: Region where this resource will be managed. Defaults to the Region set in the provider configuration.

secrets GetSecretsSecret[]: One or more encrypted payload definitions from the KMS service. See secret below.
region string: Region where this resource will be managed. Defaults to the Region set in the provider configuration.

secrets Sequence[GetSecretsSecret]: One or more encrypted payload definitions from the KMS service. See secret below.
region str: Region where this resource will be managed. Defaults to the Region set in the provider configuration.

secrets List<Property Map>: One or more encrypted payload definitions from the KMS service. See secret below.
region String: Region where this resource will be managed. Defaults to the Region set in the provider configuration.

getSecrets Result

The following output properties are available:

Id string: The provider-assigned unique ID for this managed resource.
Plaintext Dictionary<string, string>: Map containing each secret name as the key with its decrypted plaintext value
Region string
Secrets List<GetSecretsSecret>

Id string: The provider-assigned unique ID for this managed resource.
Plaintext map[string]string: Map containing each secret name as the key with its decrypted plaintext value
Region string
Secrets []GetSecretsSecret

id string: The provider-assigned unique ID for this managed resource.
plaintext map(string): Map containing each secret name as the key with its decrypted plaintext value
region string
secrets list(object)

id String: The provider-assigned unique ID for this managed resource.
plaintext Map<String,String>: Map containing each secret name as the key with its decrypted plaintext value
region String
secrets List<GetSecretsSecret>

id string: The provider-assigned unique ID for this managed resource.
plaintext {[key: string]: string}: Map containing each secret name as the key with its decrypted plaintext value
region string
secrets GetSecretsSecret[]

id str: The provider-assigned unique ID for this managed resource.
plaintext Mapping[str, str]: Map containing each secret name as the key with its decrypted plaintext value
region str
secrets Sequence[GetSecretsSecret]

id String: The provider-assigned unique ID for this managed resource.
plaintext Map<String>: Map containing each secret name as the key with its decrypted plaintext value
region String
secrets List<Property Map>

Supporting Types

GetSecretsSecret

Name string: Name to export this secret under in the attributes.
Payload string: Base64 encoded payload, as returned from a KMS encrypt operation.
Context Dictionary<string, string>: Mapping that makes up the Encryption Context for the secret.
EncryptionAlgorithm string: Encryption algorithm used to decrypt the ciphertext. This parameter is required only when the ciphertext was encrypted under an asymmetric KMS key. Valid Values: SYMMETRIC_DEFAULT | RSAES_OAEP_SHA_1 | RSAES_OAEP_SHA_256 | SM2PKE
GrantTokens List<string>: List of Grant Tokens for the secret.
KeyId string: KMS key that AWS KMS uses to decrypt the ciphertext. This parameter is required only when the ciphertext was encrypted under an asymmetric KMS key.

Name string: Name to export this secret under in the attributes.
Payload string: Base64 encoded payload, as returned from a KMS encrypt operation.
Context map[string]string: Mapping that makes up the Encryption Context for the secret.
EncryptionAlgorithm string: Encryption algorithm used to decrypt the ciphertext. This parameter is required only when the ciphertext was encrypted under an asymmetric KMS key. Valid Values: SYMMETRIC_DEFAULT | RSAES_OAEP_SHA_1 | RSAES_OAEP_SHA_256 | SM2PKE
GrantTokens []string: List of Grant Tokens for the secret.
KeyId string: KMS key that AWS KMS uses to decrypt the ciphertext. This parameter is required only when the ciphertext was encrypted under an asymmetric KMS key.

name string: Name to export this secret under in the attributes.
payload string: Base64 encoded payload, as returned from a KMS encrypt operation.
context map(string): Mapping that makes up the Encryption Context for the secret.
encryption_algorithm string: Encryption algorithm used to decrypt the ciphertext. This parameter is required only when the ciphertext was encrypted under an asymmetric KMS key. Valid Values: SYMMETRIC_DEFAULT | RSAES_OAEP_SHA_1 | RSAES_OAEP_SHA_256 | SM2PKE
grant_tokens list(string): List of Grant Tokens for the secret.
key_id string: KMS key that AWS KMS uses to decrypt the ciphertext. This parameter is required only when the ciphertext was encrypted under an asymmetric KMS key.

name String: Name to export this secret under in the attributes.
payload String: Base64 encoded payload, as returned from a KMS encrypt operation.
context Map<String,String>: Mapping that makes up the Encryption Context for the secret.
encryptionAlgorithm String: Encryption algorithm used to decrypt the ciphertext. This parameter is required only when the ciphertext was encrypted under an asymmetric KMS key. Valid Values: SYMMETRIC_DEFAULT | RSAES_OAEP_SHA_1 | RSAES_OAEP_SHA_256 | SM2PKE
grantTokens List<String>: List of Grant Tokens for the secret.
keyId String: KMS key that AWS KMS uses to decrypt the ciphertext. This parameter is required only when the ciphertext was encrypted under an asymmetric KMS key.

name string: Name to export this secret under in the attributes.
payload string: Base64 encoded payload, as returned from a KMS encrypt operation.
context {[key: string]: string}: Mapping that makes up the Encryption Context for the secret.
encryptionAlgorithm string: Encryption algorithm used to decrypt the ciphertext. This parameter is required only when the ciphertext was encrypted under an asymmetric KMS key. Valid Values: SYMMETRIC_DEFAULT | RSAES_OAEP_SHA_1 | RSAES_OAEP_SHA_256 | SM2PKE
grantTokens string[]: List of Grant Tokens for the secret.
keyId string: KMS key that AWS KMS uses to decrypt the ciphertext. This parameter is required only when the ciphertext was encrypted under an asymmetric KMS key.

name str: Name to export this secret under in the attributes.
payload str: Base64 encoded payload, as returned from a KMS encrypt operation.
context Mapping[str, str]: Mapping that makes up the Encryption Context for the secret.
encryption_algorithm str: Encryption algorithm used to decrypt the ciphertext. This parameter is required only when the ciphertext was encrypted under an asymmetric KMS key. Valid Values: SYMMETRIC_DEFAULT | RSAES_OAEP_SHA_1 | RSAES_OAEP_SHA_256 | SM2PKE
grant_tokens Sequence[str]: List of Grant Tokens for the secret.
key_id str: KMS key that AWS KMS uses to decrypt the ciphertext. This parameter is required only when the ciphertext was encrypted under an asymmetric KMS key.

name String: Name to export this secret under in the attributes.
payload String: Base64 encoded payload, as returned from a KMS encrypt operation.
context Map<String>: Mapping that makes up the Encryption Context for the secret.
encryptionAlgorithm String: Encryption algorithm used to decrypt the ciphertext. This parameter is required only when the ciphertext was encrypted under an asymmetric KMS key. Valid Values: SYMMETRIC_DEFAULT | RSAES_OAEP_SHA_1 | RSAES_OAEP_SHA_256 | SM2PKE
grantTokens List<String>: List of Grant Tokens for the secret.
keyId String: KMS key that AWS KMS uses to decrypt the ciphertext. This parameter is required only when the ciphertext was encrypted under an asymmetric KMS key.

Package Details

Repository: AWS Classic pulumi/pulumi-aws
License: Apache-2.0
Notes: This Pulumi package is based on the aws Terraform Provider.

Viewing docs for AWS v7.50.0
published on Thursday, Oct 8, 2026 by Pulumi

Schema (JSON)

pulumi/pulumi-aws

aws.kms.getSecrets

On this page

On this page

Example Usage

Using getSecrets

getSecrets Result

Supporting Types

GetSecretsSecret

Package Details

On this page

On this page

Try Pulumi Cloud free.
Your team will thank you.

aws.kms.getSecrets

On this page

On this page

Example Usage

Using getSecrets

getSecrets Result

Supporting Types

GetSecretsSecret

Package Details

On this page

On this page

Try Pulumi Cloud free.Your team will thank you.

Try Pulumi Cloud free.
Your team will thank you.