# AWS Secrets Manager component

> The `aws-secrets-manager` component creates, reads, updates, rotates and deletes secrets in AWS Secrets Manager, and the `{{aws:...}}` placeholder puts secrets into routes and endpoint options.

**Scheme:** `aws-secrets-manager:` · **Crate:** `cameleer-cloud` · **Cargo feature:** [`cloud`](../guides/build-features.md) · **Consumer:** no · **Producer:** yes ·
**Apache Camel:** [AWS Secrets Manager](https://camel.apache.org/components/next/aws-secrets-manager-component.html)

## When to use it

- Keep passwords, API keys and tokens out of route files: reference them as `{{aws:name}}`.
- Store credentials generated by a route (for example a partner token) as a secret.
- Restart routes automatically when a secret is rotated (secret refresh).

## URI format

```text
aws-secrets-manager://label?operation=...[&options]
```

## Example

Use a secret in a route with the `{{aws:...}}` placeholder. It is resolved when the route starts:

<!-- example: aws-secrets-manager-placeholder -->
```yaml
- route:
    id: call-partner-api
    from:
      uri: "timer:partner-sync?repeatCount=1"
      steps:
        - setHeader:
            name: Authorization
            constant: "Bearer {{aws:partner-api/token}}"
        - to: "log:partner-api"
```

The placeholder reads its configuration from these properties (for example in
`application.properties`):

```properties
camel.vault.aws.region=eu-west-1
camel.vault.aws.defaultCredentialsProvider=true
```

Create a secret:

<!-- example: aws-secrets-manager-create-secret -->
```yaml
- route:
    id: store-partner-token
    from:
      uri: "timer:store-token?repeatCount=1"
      steps:
        - setHeader:
            name: CamelAwsSecretsManagerSecretName
            constant: partner-api
        - setHeader:
            name: CamelAwsSecretsManagerSecretDescription
            constant: Token of the partner API
        - setBody:
            constant: '{"token":"{{env:PARTNER_TOKEN:}}"}'
        - to: "aws-secrets-manager://secrets?region={{env:AWS_REGION:us-east-1}}&operation=createSecret"
        - log: "created ${body} (version ${header.CamelAwsSecretsManagerSecretVersionId})"
```

## Rust DSL

```rust
ctx.add_routes(|b| {
    b.from("timer:store-token?repeatCount=1")
        .set_header("CamelAwsSecretsManagerSecretName", constant("partner-api"))
        .set_header("CamelAwsSecretsManagerSecretDescription", constant("Token of the partner API"))
        .set_body(constant(r#"{"token":"{{env:PARTNER_TOKEN:}}"}"#))
        .to("aws-secrets-manager://secrets?region={{env:AWS_REGION:us-east-1}}&operation=createSecret")
        .log("created ${body} (version ${header.CamelAwsSecretsManagerSecretVersionId})");
})?;
```

## Options

Common AWS options (region, credentials, endpoint override, proxy) are listed in
[Cloud credentials](../guides/cloud-credentials.md#aws-options).

| option | default | description |
|---|---|---|
| `operation` | `getSecret` | `createSecret`, `getSecret`, `describeSecret`, `listSecrets`, `deleteSecret`, `restoreSecret`, `updateSecret`, `rotateSecret`, `replicateSecretToRegions`. |
| `binaryPayload` | `false` | `createSecret`: store a bytes body as `SecretBinary`. |

### The `{{aws:...}}` placeholder

| syntax | result |
|---|---|
| `{{aws:name}}` | The secret string. |
| `{{aws:name/field}}` | A field of a JSON secret, for example `{{aws:prod-db/password}}` reads `password` of the JSON secret `prod-db`. |
| `{{aws:name@version}}` | A specific version. |
| `{{aws:name/field:default}}` | A default when the secret or field does not exist. |

The secret name ends at the first `/`, as in Apache Camel: a secret whose name contains `/` (such as
`prod/db`) cannot be read with the placeholder. Use names like `prod-db` and JSON fields instead.

Configuration properties: `camel.vault.aws.accessKey`, `secretKey`, `region`,
`defaultCredentialsProvider`, `profileCredentialsProvider`, `profileName`, `uriEndpointOverride`,
`overrideEndpoint`. Secret refresh: `camel.vault.aws.refreshEnabled=true`,
`camel.vault.aws.refreshPeriod` (ms, default 30000) and `camel.vault.aws.secrets` (names or `*`
patterns; empty = the secrets used through placeholders). Changes are detected through CloudTrail
events (`PutSecretValue`, `UpdateSecret`, `RotateSecret`, ...) and restart the started routes.

## Message headers

| header | direction | description |
|---|---|---|
| `CamelAwsSecretsManagerOperation` | in | Overrides `operation`. |
| `CamelAwsSecretsManagerSecretName` | in | Name of `createSecret`. |
| `CamelAwsSecretsManagerSecretDescription` | in | Description of `createSecret`. |
| `CamelAwsSecretsManagerSecretId` | in | Name or ARN for the other operations. |
| `CamelAwsSecretsManagerSecretVersionId` | in/out | Version to read; the new version after create. |
| `CamelAwsSecretsManagerForceDeletion` | in | `deleteSecret` without recovery window. |
| `CamelAwsSecretsManagerLambdaRotationFunctionArn`, `CamelAwsSecretsManagerRotateImmediately` | in | `rotateSecret`. |
| `CamelAwsSecretsManagerSecretReplicationRegions` | in | `replicateSecretToRegions`. |

## Run it with Docker

```sh
docker run --rm -e AWS_REGION -e AWS_ACCESS_KEY_ID -e AWS_SECRET_ACCESS_KEY \
  -v "$PWD:/routes:ro" pmsudhi/cameleer run /routes/partner.camel.yaml \
  --properties /routes/application.properties
```

`--prop camel.vault.aws.region=eu-west-1` sets a single property on the command line.

## Common questions

### How do I put a database password into an endpoint option?

Write it in the uri, for example `password=RAW({{aws:prod-db/password}})`. `RAW(...)` keeps special
characters of the password intact.

### What does `getSecret` return for binary secrets?

The bytes of `SecretBinary`; string secrets are returned as text.

## Related

- [Azure Key Vault](azure-key-vault.md) (`{{azure:...}}`)
- [AWS CloudTrail](aws-cloudtrail.md), [AWS KMS](aws2-kms.md)
- [Cloud credentials](../guides/cloud-credentials.md)
- [Apache Camel AWS Secrets Manager](https://camel.apache.org/components/next/aws-secrets-manager-component.html)

## Found a problem?

If something on this page doesn't match what Cameleer does, or you hit a bug while building
with it, please help fix it, whether you are a person or a coding agent:
[open an issue](https://github.com/pmsudhi/cameleer/issues/new) that describes what you saw,
then fork the repository, fix it, add or update a test, run `cargo test --workspace`, and open
a pull request. [CONTRIBUTING.md](https://github.com/pmsudhi/cameleer/blob/main/CONTRIBUTING.md)
explains the ground rules.