AWS Secrets Manager

AWS Secrets Manager is Amazon's cloud service for securely storing and managing secrets, API keys, and other sensitive data. The EnvManager AWS Secrets Manager integration allows you to automatically sync your environment variables from EnvManager directly to secrets in AWS Secrets Manager.

When you connect AWS Secrets Manager to EnvManager, each variable is stored as an individual secret in your chosen AWS region. No more manually creating secrets or copying values between tools.

What You Can Do

With the AWS Secrets Manager integration, you can:

• Connect your AWS account with an IAM access key and secret
• Sync variables as secrets — each variable becomes its own secret in Secrets Manager
• Use a name prefix to namespace your secrets with path-style organization (e.g., envmanager/production/)
• Choose which environments to sync — control exactly which EnvManager environments push to AWS
• Automatic syncing — secrets update in AWS whenever you change variables in EnvManager
• Manual sync control — trigger syncs on demand when you need them
• Track sync history — see when secrets were synced and if any errors occurred

Before You Begin

To connect AWS Secrets Manager, you need:

• An EnvManager account with a project created
• An AWS account
• Admin or Owner role in your EnvManager organization (required to manage integrations)
• An IAM user with programmatic access (access key ID and secret access key)
• IAM permissions for Secrets Manager (CreateSecret, PutSecretValue, DeleteSecret)

The sections below walk you through creating an IAM user, attaching the correct permissions, and connecting to EnvManager.

How to Create an IAM User

If you already have an IAM user with the required permissions, you can skip to Connecting Your AWS Secrets Manager.

Minimal IAM Policy

Use this policy to grant only the permissions EnvManager needs:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "secretsmanager:CreateSecret",
        "secretsmanager:PutSecretValue",
        "secretsmanager:DeleteSecret"
      ],
      "Resource": "arn:aws:secretsmanager:*:*:secret:envmanager/*"
    }
  ]
}

Connecting Your AWS Secrets Manager

Configuring Your Sync

After connecting AWS Secrets Manager, you need to configure which environments sync and how secrets are named.

Syncing Variables

Automatic Syncing

If you enabled auto-sync, EnvManager will automatically push variables to AWS Secrets Manager whenever:

• You add a new variable (creates a new secret)
• You edit an existing variable's value (updates the secret)
• You delete a variable (the secret is deleted from AWS)

Changes typically appear in AWS within seconds.

Manual Syncing

You can trigger a sync manually at any time:

Secret Naming in AWS

AWS Secrets Manager has flexible naming rules that allow most characters:

• Letters, numbers, and these special characters are allowed: / _ + = . @ -
• Maximum length is 512 characters
• Path-style names with / separators are supported natively

If you set a prefix, it is prepended to each variable name:

Managing Your Connection

Updating Configuration

To change which environments sync or update the prefix:

1. Click Configure on the AWS Secrets Manager integration card
2. Make your changes
3. Click Save Configuration

The new configuration takes effect immediately for the next sync.

Disconnecting AWS Secrets Manager

To remove the AWS Secrets Manager integration:

1. Click the Disconnect button on the integration card
2. Confirm the disconnection in the dialog that appears

Reconnecting

If you disconnect and want to reconnect later:

• Click Connect again and go through the connection process
• You can use the same IAM credentials or create new access keys
• You'll need to reconfigure your environment toggles and prefix

Tips & Best Practices

Start with Manual Sync

When setting up the integration for the first time:

1. Configure with auto-sync disabled
2. Trigger a manual sync to verify secrets appear in AWS Secrets Manager
3. Confirm the secret names and values look correct in the AWS console
4. Enable auto-sync once you're confident everything is working

Use a Prefix to Namespace Your Secrets

If your AWS Secrets Manager is used for multiple applications or already has existing secrets, use a path-style prefix to keep EnvManager-managed secrets clearly identified. For example, envmanager/production/ makes it obvious which secrets belong to this application and environment.

Rotate Access Keys Periodically

AWS recommends rotating access keys regularly. To rotate:

1. Create a new access key for the IAM user in the AWS console
2. Update the connection in EnvManager by disconnecting and reconnecting with the new key
3. Delete the old access key from the IAM user
4. Verify syncing works with the new credentials

Limit IAM Permissions

The minimal IAM policy above grants only the permissions EnvManager needs — CreateSecret, PutSecretValue, and DeleteSecret. Avoid granting broader permissions like secretsmanager:* or attaching the SecretsManagerReadWrite managed policy, which provides more access than needed.

Troubleshooting

"Invalid AWS credentials" error during validation

Cause: The access key ID or secret access key is incorrect.

Solution:

1. Verify the access key ID starts with AKIA (for long-term credentials)
2. Make sure you copied the full secret access key when it was created
3. Check that the IAM user has not been disabled or deleted
4. If the access key was compromised and rotated, use the new credentials
5. Re-enter the credentials in EnvManager and try validation again

"Access denied" error during sync

Cause: The IAM user does not have the required Secrets Manager permissions.

Solution:

1. Open the IAM console and find the user
2. Check that the correct policy is attached (with secretsmanager:CreateSecret, PutSecretValue, DeleteSecret)
3. Verify the policy Resource ARN matches your secret prefix — if you use envmanager/prod/ as a prefix, the policy must cover arn:aws:secretsmanager:*:*:secret:envmanager/prod/*
4. Check if any Service Control Policies (SCPs) in your AWS Organization are blocking access

"Invalid region" error

Cause: The selected region is not available or the Secrets Manager service is not enabled in that region.

Solution:

1. Make sure you selected a valid AWS region from the dropdown
2. Verify Secrets Manager is available in your chosen region (it's available in all standard regions)
3. Try selecting a different region

Variables not appearing in AWS Secrets Manager

Cause: The sync may have failed, or the environment is not enabled for sync.

Solution:

1. Click Configure and verify that the relevant environments are toggled on
2. Check the sync history for error messages on the integration card
3. Trigger a manual sync and watch for errors
4. Make sure you're looking in the correct AWS region in the console

Auto-sync not triggering

Cause: Auto-sync may be disabled in the configuration, or the sync is failing silently.

Solution:

1. Click Configure and verify Auto-sync is enabled
2. Check the sync history for recent failed syncs
3. Try a manual sync to confirm the connection is still working
4. If access keys were rotated, reconnect with the new credentials

Related Topics