Class AwsSecretsManagerTools

constructor

• new AwsSecretsManagerTools(
      __namedParameters?: AwsSecretsManagerToolsOptions,
  ): AwsSecretsManagerTools

  Construct an AwsSecretsManagerTools instance.

  Parameters

  • __namedParameters: AwsSecretsManagerToolsOptions = {}

  Returns AwsSecretsManagerTools

  Throws

  If clientConfig.logger is provided but does not implement debug, info, warn, and error.

  Throws

  If X-Ray capture is enabled (via xray: 'on' or xray: 'auto' with AWS_XRAY_DAEMON_ADDRESS set) but aws-xray-sdk is not installed.

  Throws

  If X-Ray capture is requested but AWS_XRAY_DAEMON_ADDRESS is not set.

Readonlyclient

ReadonlyclientConfig

Readonlylogger

Readonlyxray

createEnvSecret

• createEnvSecret(
      opts: {
          description?: string;
          forceOverwriteReplicaSecret?: boolean;
          secretId: string;
          value: ProcessEnv;
          versionId?: string;
      },
  ): Promise<void>

  Create a new secret containing an env-map.

  Parameters

  • opts: {
        description?: string;
        forceOverwriteReplicaSecret?: boolean;
        secretId: string;
        value: ProcessEnv;
        versionId?: string;
    }

    Options:

    • secretId: Secret name (or ARN in some contexts).
    • value: Env-map payload to store (JSON object map).
    • description: Optional AWS secret description.
    • forceOverwriteReplicaSecret: See AWS CreateSecret behavior for replicas.
    • versionId: Optional client request token (idempotency).

  Returns Promise<void>

deleteSecret

• deleteSecret(
      opts: {
          forceDeleteWithoutRecovery?: boolean;
          recoveryWindowInDays?: number;
          secretId: string;
      },
  ): Promise<void>

  Delete a secret.

  By default, deletion is recoverable (AWS default recovery window) unless forceDeleteWithoutRecovery is set.

  Parameters

  • opts: {
        forceDeleteWithoutRecovery?: boolean;
        recoveryWindowInDays?: number;
        secretId: string;
    }

    Options:

    • secretId: Secret name or ARN.
    • recoveryWindowInDays: Explicit recovery window to use.
    • forceDeleteWithoutRecovery: Dangerous: delete without recovery.

  Returns Promise<void>

  Throws

  If both recoveryWindowInDays and forceDeleteWithoutRecovery are provided.

readEnvSecret

• readEnvSecret(
      opts: { secretId: string; versionId?: string },
  ): Promise<ProcessEnv>

  Read a Secrets Manager secret and parse it as an env-map secret.

  Parameters

  • opts: { secretId: string; versionId?: string }

    Options:

    • secretId: Secret name or ARN.
    • versionId: Optional version id to read.

  Returns Promise<ProcessEnv>

  Throws

  If the secret is missing, binary, invalid JSON, or not an object map.

updateEnvSecret

• updateEnvSecret(
      opts: { secretId: string; value: ProcessEnv; versionId?: string },
  ): Promise<void>

  Write a new version value for an existing secret.

  This does not create the secret if it does not exist.

  Parameters

  • opts: { secretId: string; value: ProcessEnv; versionId?: string }

    Options:

    • secretId: Secret name or ARN.
    • value: Env-map payload to store (JSON object map).
    • versionId: Optional client request token (idempotency).

  Returns Promise<void>

upsertEnvSecret

• upsertEnvSecret(
      __namedParameters: { secretId: string; value: ProcessEnv },
  ): Promise<"updated" | "created">

  Put a secret value, creating the secret only when it does not exist.

  This creates only when the update fails with ResourceNotFoundException; other errors are re-thrown.

  Parameters

  • __namedParameters: { secretId: string; value: ProcessEnv }

  Returns Promise<"updated" | "created">

  'updated' if updated; 'created' if the secret was created.

  Throws

  Re-throws any non-ResourceNotFound AWS errors.