28

I have a secret stored in secrets manager to which I have access to the arn. I want to retrieve the value from this arn and use it in terraform how can I achieve this?

I found this from terraform website

data "aws_secretsmanager_secret" "by-arn" {
  arn = "arn:aws:secretsmanager:us-east-1:123456789012:secret:example-123456"
}

How do I then retrieve the value? Meaning what is the "get-value" equivalent in terraform for an EC2 isntance?

John Rotenstein
  • 241,921
  • 22
  • 380
  • 470
user_mda
  • 18,148
  • 27
  • 82
  • 145

5 Answers5

52

Here is an example. By default, aws_secretsmanager_secret_version retrieves information based on the AWSCURRENT label (a.k.a. the latest version):

data "aws_secretsmanager_secret" "secrets" {
  arn = "arn:aws:secretsmanager:us-east-1:123456789012:secret:my_secrety_name-123456"
}

data "aws_secretsmanager_secret_version" "current" {
  secret_id = data.aws_secretsmanager_secret.secrets.id
}

And use data.aws_secretsmanager_secret_version.current.secret_string to get the secret. If you want to retrieve a specific value inside that secret like DATABASE_URL you can use the built-in function jsondecode:

jsondecode(data.aws_secretsmanager_secret_version.current.secret_string)["DATABASE_URL"]
pabloxio
  • 1,173
  • 7
  • 8
  • Hi ! Thank you can you please give an example of the secrets arn instead of name? @pabloxio – user_mda Jun 11 '20 at 17:07
  • 2
    You can use `arn` or `name` to retrieve the secret. I used `name` but here is an example using `arn`: `arn = "arn:aws:secretsmanager:us-east-1:123456789012:secret: my_secrety_name"` – pabloxio Jun 11 '20 at 17:32
  • so the same works for arn? can you replace the example? – user_mda Jun 11 '20 at 17:36
  • Sure... just remember that AWS adds a suffix to the AWS Secret Secret name, in this example `123456` – pabloxio Jun 11 '20 at 17:54
12

Please note that Terraform 0.14 added the ability to redact Sensitive values in console output.

Therefore, if you are using Terraform > 0.14, you will have to use nonsensitive function to expose the actual secret value.

nonsensitive function takes a sensitive value and returns a copy of that value with the sensitive marking removed, thereby exposing the actual value.

data "aws_secretsmanager_secret" "secrets" {
  arn = "arn:aws:secretsmanager:us-east-1:123456789012:secret:my_secrety_name-123456"
}

data "aws_secretsmanager_secret_version" "current" {
  secret_id = data.aws_secretsmanager_secret.secrets.id
}

output "sensitive_example_hash" {
  value = jsondecode(nonsensitive(data.aws_secretsmanager_secret_version.current.secret_string))
}
Sufiyan Ghori
  • 18,164
  • 14
  • 82
  • 110
  • 2
    Note, don't ever make real sensitive data an output like this, because outputs are saved as plaintext in terraform state files. – Jordan Morris Mar 10 '22 at 09:49
3

Instead of hardcoding ARN or the AWS account ID

    data "aws_secretsmanager_secret" "example_secret" {
      name = "<secret_name>" # As stored in the AWS Secrets Manager
    }

    # Give a meaningful name to the version for easy identification
    # If multiple secrets are present
    data "aws_secretsmanager_secret_version" "example_latest_ver" {
      secret_id = data.aws_secretsmanager_secret.example_secret.id
    }

And, simply refer this in your code as data.aws_secretsmanager_secret_version.example_latest_ver.secret_string

To find out, the current AWS account ID, use ${data.aws_caller_identity.current.account_id}

m_drinks_coffee
  • 436
  • 8
  • 24
1

aws_secretsmanager_secret is a AWS secretsmanager secret object, but a secret can have multiple versions, and the values are stored in the versions, not in the parent secret object.

So this is what you're looking for instead: https://www.terraform.io/docs/providers/aws/r/secretsmanager_secret_version.html (and it describes how to get the value of the secret version, ie. aws_secretsmanager_secret_version.example.secret_string).

weichung.shaw
  • 144
  • 1
1

Please take notice that Sensitive values can now be redacted from the terminal output in Terraform 0.14.

So, in order to reveal the true secret value when using Terraform > 0.14, you must use a nonsensitive function.

A sensitive value is sent to the nonsensitive function, which returns a duplicate of the value with the sensitive tag removed, revealing the true value.

data "aws_secretsmanager_secret" "ms_secrets" {
    arn = "arn:aws:secretsmanager:us-east-1:7777777777:secret:secrety_name"
}

data "aws_secretsmanager_secret_version" "secret_version" {
  secret_id = data.aws_secretsmanager_secret.ms_secrets.id
}

output "secret_string" {
  value = jsondecode(nonsensitive(data.aws_secretsmanager_secret_version.secret_version.secret_string))
}
Shahbaz Rahmat
  • 51
  • 4