SecretsManager / Client / associate_cross_account_replica

associate_cross_account_replica

SecretsManager.Client.associate_cross_account_replica(**kwargs)

Links a primary secret in your account to a replica secret in a different Amazon Web Services account and starts replication to this replica. The replica secret must already exist in the other Amazon Web Services account. Create the replica with CreateSecret and set its CrossAccountPrimaryARN field set to this primary secret’s ARN. When you call AssociateCrossAccountReplica, Secrets Manager calls AcceptCrossAccountReplication on the replica secret on your behalf.

The primary and replica secrets must be in the same Amazon Web Services Region and partition, and you must call this operation from the account that owns the primary secret. A primary secret can have at most one cross-account replica. This operation is idempotent, so you can call it again for the same replica to repair replication. If the association fails, Secrets Manager does not modify either the primary or replica secret.

Secrets Manager generates a CloudTrail log entry when you call this action. Do not include sensitive information in request parameters because it might be logged. For more information, see Logging Secrets Manager events with CloudTrail.

Required permissions: secretsmanager:AssociateCrossAccountReplica, secretsmanager:GetSecretValue on the primary secret, and secretsmanager:AcceptCrossAccountReplication on the replica secret. You must also have kms:Decrypt permission for the Key Management Service (KMS) key that encrypts the primary secret, and kms:Encrypt permission for the Amazon Web Services KMS key that encrypts the replica secret. If you supply ReplicationRoleARN, you also need iam:PassRole for that role. For more information, see IAM policy actions for Secrets Manager and Authentication and access control in Secrets Manager.

See also: AWS API Documentation

Request Syntax

response = client.associate_cross_account_replica(
    SecretId='string',
    CrossAccountReplicaARN='string',
    ReplicaRestriction='SameOrg'|'NoRestriction',
    ReplicationRoleARN='string'
)
Parameters:

  • SecretId (string) –

    [REQUIRED]

    The ARN or name of the primary secret in your account to replicate.

    For an ARN, we recommend that you specify a complete ARN rather than a partial ARN. See Finding a secret from a partial ARN.

  • CrossAccountReplicaARN (string) –

    [REQUIRED]

    The ARN of the replica secret in the other Amazon Web Services account. The replica secret must be in the same Region and partition as the primary secret. Additionally, the replica account owner must have created the replica secret as a cross-account replica of the primary secret. For more information see CreateSecret.

  • ReplicaRestriction (string) –

    Whether the replica account must belong to the same Amazon Web Services organization as the primary account:

    • SameOrg, which requires the replica account to be in the same organization as the primary account. This is the default.

    • NoRestriction, which allows the replica account to be in any organization.

  • ReplicationRoleARN (string) – The ARN of an IAM role in the primary account that Secrets Manager assumes to perform replication. If you don’t include this field, Secrets Manager replicates using the credentials of caller who updates the primary secret. For more information, see Cross-account replication permissions.

Return type:

dict

Returns:

Response Syntax

{
    'ARN': 'string',
    'CrossAccountReplicaARN': 'string',
    'ReplicationStatus': 'InSync'|'Failed'|'InProgress'|'Pending'|'Detached'
}

Response Structure

  • (dict) –

    • ARN (string) –

      The ARN of the primary secret.

    • CrossAccountReplicaARN (string) –

      The ARN of the replica secret in the other account.

    • ReplicationStatus (string) –

      The status of replication to the replica secret. Possible values:

      • InSync, which indicates that replication to the replica completed successfully and the replica is up to date.

      • Failed, which indicates that replication to the replica did not succeed.

      • InProgress, which indicates that Secrets Manager is replicating to the replica.

      • Pending, which indicates that replication has not yet started.

      • Detached, which indicates that primary secret is no longer linked to the replica secret.

Exceptions

  • SecretsManager.Client.exceptions.ResourceNotFoundException

  • SecretsManager.Client.exceptions.InvalidRequestException

  • SecretsManager.Client.exceptions.InvalidParameterException

  • SecretsManager.Client.exceptions.LimitExceededException

  • SecretsManager.Client.exceptions.InternalServiceError