Container for the parameters to the UpdateSecret operation. Modifies the details of a secret, including metadata and the secret value. To change the secret value, you can also use PutSecretValue.
To change the rotation configuration of a secret, use RotateSecret instead.
To change a secret so that it is managed by another service, you need to recreate the secret in that service. See Secrets Manager secrets managed by other Amazon Web Services services.
We recommend you avoid calling UpdateSecret at a sustained rate of more than
once every 10 minutes. When you call UpdateSecret to update the secret value,
Secrets Manager creates a new version of the secret. Secrets Manager removes outdated
versions when there are more than 100, but it does not remove versions created less
than 24 hours ago. If you update the secret value more than once every 10 minutes,
you create more versions than Secrets Manager removes, and you will reach the quota
for secret versions.
If you include SecretString or SecretBinary to create a new secret version,
Secrets Manager automatically moves the staging label AWSCURRENT to the new
version. Then it attaches the label AWSPREVIOUS to the version that AWSCURRENT
was removed from.
If you call this operation with a ClientRequestToken that matches an existing
version's VersionId, the operation results in an error. You can't modify an
existing version, you can only create a new version. To remove a version, remove all
staging labels from it. See UpdateSecretVersionStage.
Secrets Manager generates a CloudTrail log entry when you call this action. Do not
include sensitive information in request parameters except SecretBinary or
SecretString because it might be logged. For more information, see Logging
Secrets Manager events with CloudTrail.
Required permissions: secretsmanager:UpdateSecret. For more information,
see
IAM policy actions for Secrets Manager and Authentication
and access control in Secrets Manager. If you use a customer managed key, you
must also have kms:GenerateDataKey, kms:Encrypt, and kms:Decrypt
permissions on the key. If you change the KMS key and you don't have kms:Encrypt
permission to the new key, Secrets Manager does not re-encrypt existing secret versions
with the new key. For more information, see
Secret encryption and decryption.
When you enter commands in a command shell, there is a risk of the command history being accessed or utilities having access to your command parameters. This is a concern if the command includes the value of a secret. Learn how to Mitigate the risks of using command-line tools to store Secrets Manager secrets.
Inheritance Hierarchy
Amazon.Runtime.AmazonWebServiceRequest
Amazon.SecretsManager.AmazonSecretsManagerRequest
Amazon.SecretsManager.Model.UpdateSecretRequest
Namespace: Amazon.SecretsManager.Model
Assembly: AWSSDK.SecretsManager.dll
Version: 3.x.y.z
Syntax
public class UpdateSecretRequest : AmazonSecretsManagerRequest IAmazonWebServiceRequest
The UpdateSecretRequest type exposes the following members
Constructors
| Name | Description | |
|---|---|---|
|
UpdateSecretRequest() |
Properties
| Name | Type | Description | |
|---|---|---|---|
|
|
ClientRequestToken | System.String |
Gets and sets the property ClientRequestToken.
If you include If you use the Amazon Web Services CLI or one of the Amazon Web Services SDKs to call this operation, then you can leave this parameter empty. The CLI or SDK generates a random UUID for you and includes it as the value for this parameter in the request.
If you generate a raw HTTP request to the Secrets Manager service endpoint, then you
must generate a This value helps ensure idempotency. Secrets Manager uses this value to prevent the accidental creation of duplicate versions if there are failures and retries during a rotation. We recommend that you generate a UUID-type value to ensure uniqueness of your versions within the specified secret. |
|
|
Description | System.String |
Gets and sets the property Description. The description of the secret. |
|
|
KmsKeyId | System.String |
Gets and sets the property KmsKeyId.
The ARN, key ID, or alias of the KMS key that Secrets Manager uses to encrypt new
secret versions as well as any existing versions with the staging labels
A key alias is always prefixed by
If you set this to an empty string, Secrets Manager uses the Amazon Web Services managed
key
You can only use the Amazon Web Services managed key |
|
|
SecretBinary | System.IO.MemoryStream |
Gets and sets the property SecretBinary. The binary data to encrypt and store in the new version of the secret. We recommend that you store your binary data in a file and then pass the contents of the file as a parameter.
Either You can't access this parameter in the Secrets Manager console. Sensitive: This field contains sensitive information, so the service does not include it in CloudTrail log entries. If you create your own log entries, you must also avoid logging the information in this field. |
|
|
SecretId | System.String |
Gets and sets the property SecretId. The ARN or name of the secret. For an ARN, we recommend that you specify a complete ARN rather than a partial ARN. See Finding a secret from a partial ARN. |
|
|
SecretString | System.String |
Gets and sets the property SecretString. The text data to encrypt and store in the new version of the secret. We recommend you use a JSON structure of key/value pairs for your secret value.
Either Sensitive: This field contains sensitive information, so the service does not include it in CloudTrail log entries. If you create your own log entries, you must also avoid logging the information in this field. |
Examples
The following example shows how to modify the description of a secret.
To update the description of a secret
var client = new AmazonSecretsManagerClient();
var response = client.UpdateSecret(new UpdateSecretRequest
{
ClientRequestToken = "EXAMPLE1-90ab-cdef-fedc-ba987EXAMPLE",
Description = "This is a new description for the secret.",
SecretId = "MyTestDatabaseSecret"
});
string arn = response.ARN;
string name = response.Name;
This example shows how to update the KMS customer managed key (CMK) used to encrypt the secret value. The KMS CMK must be in the same region as the secret.
To update the KMS key associated with a secret
var client = new AmazonSecretsManagerClient();
var response = client.UpdateSecret(new UpdateSecretRequest
{
KmsKeyId = "arn:aws:kms:us-west-2:123456789012:key/EXAMPLE2-90ab-cdef-fedc-ba987EXAMPLE",
SecretId = "MyTestDatabaseSecret"
});
string arn = response.ARN;
string name = response.Name;
The following example shows how to create a new version of the secret by updating the SecretString field. Alternatively, you can use the put-secret-value operation.
To create a new version of the encrypted secret value
var client = new AmazonSecretsManagerClient();
var response = client.UpdateSecret(new UpdateSecretRequest
{
SecretId = "MyTestDatabaseSecret",
SecretString = "{JSON STRING WITH CREDENTIALS}"
});
string arn = response.ARN;
string name = response.Name;
string versionId = response.VersionId;
Version Information
.NET:
Supported in: 8.0 and newer, Core 3.1
.NET Standard:
Supported in: 2.0
.NET Framework:
Supported in: 4.5 and newer, 3.5