Terraform AWS Secrets Manager

Secrets, secret versions, rotation schedules, KMS encryption, resource policies, replication, and controlled retrieval of database passwords, API keys, and tokens.

Quick start

module "secrets-manager" {
  source  = "cccsmedium.compliance.tf/terraform-aws-modules/secrets-manager/aws"
  version = "~> 2.2"

  # ... your arguments here
}

module "secrets-manager" {
  source  = "cfrpart11.compliance.tf/terraform-aws-modules/secrets-manager/aws"
  version = "~> 2.2"

  # ... your arguments here
}

module "secrets-manager" {
  source  = "eugmpannex11.compliance.tf/terraform-aws-modules/secrets-manager/aws"
  version = "~> 2.2"

  # ... your arguments here
}

module "secrets-manager" {
  source  = "hipaa.compliance.tf/terraform-aws-modules/secrets-manager/aws"
  version = "~> 2.2"

  # ... your arguments here
}

module "secrets-manager" {
  source  = "nist80053.compliance.tf/terraform-aws-modules/secrets-manager/aws"
  version = "~> 2.2"

  # ... your arguments here
}

module "secrets-manager" {
  source  = "nydfs23.compliance.tf/terraform-aws-modules/secrets-manager/aws"
  version = "~> 2.2"

  # ... your arguments here
}

module "secrets-manager" {
  source  = "pcidss.compliance.tf/terraform-aws-modules/secrets-manager/aws"
  version = "~> 2.2"

  # ... your arguments here
}

This module on the compliance.tf registry lists its versions, inputs and outputs. The Get Started guide and Registry Endpoints cover authentication and how to customize the module for your requirements.

Migration from upstream

Already using terraform-aws-modules? Change only the source URL:

module "secrets-manager" {
  source  = "terraform-aws-modules/secrets-manager/aws"
  version = "~> 2.2"
}

module "secrets-manager" {
  source  = "soc2.compliance.tf/terraform-aws-modules/secrets-manager/aws"
  version = "~> 2.2"
}

Same arguments. Same outputs. Controls are checked at terraform plan. The Migration Guide has the step-by-step version.

Reversibility

No lock-in. Switch back by reverting the source URL:

module "secrets-manager" {
  source  = "terraform-aws-modules/secrets-manager/aws"
}

Run terraform init -upgrade. Terraform state is unchanged: same resource addresses, same provider, no compliance.tf-specific resources. Controls you already applied remain in AWS.

Controls enforced

Up to 1 controls are checked at terraform plan when this module comes from a compliance.tf endpoint. Which ones are active depends on the endpoint; see Framework coverage.

Control	Retrofit effort
Secrets Manager secrets should be encrypted using CMK	Low

Mapped compliance frameworks

Clause	Controls from this module
SC-12(3): Asymmetric Keys	Secrets Manager secrets should be encrypted using CMK

Clause	Controls from this module
11.30 Controls for open systems	Secrets Manager secrets should be encrypted using CMK

Clause	Controls from this module
7.1 Data Storage - Damage Protection	Secrets Manager secrets should be encrypted using CMK

Clause	Controls from this module
164.312(e)(2)(ii) Encryption	Secrets Manager secrets should be encrypted using CMK

1 controls from this module are active under NIST SP 800-53 Rev 5.

Clause	Controls from this module
500.15(a)	Secrets Manager secrets should be encrypted using CMK

Clause	Controls from this module
8.3.2: Strong authentication for users and administrators is established and managed.	Secrets Manager secrets should be encrypted using CMK
8.3.2: Strong cryptography is used to render all authentication factors unreadable during transmission and storage on all system components	Secrets Manager secrets should be encrypted using CMK

Framework coverage

Which controls from this module are active under each framework endpoint. Your framework preferences choose the columns.

Control	HIPAA Omnibus Rule 2013	PCI DSS v4.0
Secrets Manager secrets should be encrypted using CMK	Enforced	Enforced

Known Terraform limitations

Separately from the controls above, some things people ask this module for cannot be implemented by any module in any registry: they are limits of Terraform itself. Known limitations for this module lists the recurring ones: what causes each, the native workaround in full, and, where one exists, the opt-in Operational Rule that removes the need for a fork.

1 controls enforced with a source URL change.

Start free trial Get started