Stop cross-account replication

Either account can stop cross-account replication at any time, and there is no required order between the two accounts:

• The primary-account owner stops replication with DisassociateCrossAccountReplica.

• The replica-account owner stops replication with StopReplicationToReplica.

When an account stops replication, Secrets Manager removes the replication information from that side. Calling DisassociateCrossAccountReplica on the primary secret removes the replica entry from the primary secret's list of replicas. Calling StopReplicationToReplica on the replica secret removes the cross-account primary information from the replica secret. StopReplicationToReplica also removes the system-managed resource policy named cross-account-replication that Secrets Manager attached to the replica secret during CreateSecret. Because StopReplicationToReplica removes that managed policy, the caller must also have the secretsmanager:DeleteResourcePolicy permission. You can further qualify the delete permission with the secretsmanager:PolicyName condition key.

Important

Secrets Manager blocks you from deleting a secret until that account has stopped replication from its own side. Before you delete the primary secret, run DisassociateCrossAccountReplica in the primary account. Before you delete the replica secret, run StopReplicationToReplica in the replica account.

AWS CLI

Example Stop replication from the primary account

The following DisassociateCrossAccountReplica example stops replication from the primary side.

aws secretsmanager disassociate-cross-account-replica \
    --secret-id MyPrimarySecret \
    --cross-account-replica-arn arn:aws:secretsmanager:us-east-2:444455556666:secret:MyReplicaSecret-a1b2c3

{
    "ARN": "arn:aws:secretsmanager:us-east-2:111122223333:secret:MyPrimarySecret-a1b2c3",
    "CrossAccountReplicaARN": "arn:aws:secretsmanager:us-east-2:444455556666:secret:MyReplicaSecret-a1b2c3"
}

Example Stop replication from the replica account

The following StopReplicationToReplica example stops replication from the replica side.

aws secretsmanager stop-replication-to-replica \
    --secret-id MyReplicaSecret

{
    "ARN": "arn:aws:secretsmanager:us-east-2:444455556666:secret:MyReplicaSecret-a1b2c3"
}

AWS SDK

To stop replication from the primary account, use the DisassociateCrossAccountReplica command. To stop replication from the replica account, use the StopReplicationToReplica command. For more information, see AWS SDKs.