AWS Secrets Manager

AWS Secrets Manager is Amazon's cloud service for securely storing and managing secrets, API keys, and other sensitive data. The EnvManager AWS Secrets Manager integration allows you to automatically sync your environment variables from EnvManager directly to secrets in AWS Secrets Manager.

When you connect AWS Secrets Manager to EnvManager, each variable is stored as an individual secret in your chosen AWS region. No more manually creating secrets or copying values between tools.

What You Can Do

With the AWS Secrets Manager integration, you can:

• Connect your AWS account with an IAM access key and secret
• Sync variables as secrets — each variable becomes its own secret in Secrets Manager
• Use a name prefix to namespace your secrets per environment (e.g., PROD so DATABASE_URL becomes PROD_DATABASE_URL)
• Choose which environments to sync — control exactly which EnvManager environments push to AWS
• Automatic syncing — secrets update in AWS whenever you change variables in EnvManager
• Manual sync control — trigger syncs on demand when you need them
• Track sync history — see when secrets were synced and if any errors occurred

Before You Begin

To connect AWS Secrets Manager, you need:

• An EnvManager account with a project created
• An AWS account
• Admin or Owner role in your EnvManager organization (required to manage integrations)
• An IAM user with programmatic access (access key ID and secret access key)
• IAM permissions for Secrets Manager (CreateSecret, PutSecretValue, DeleteSecret)

The sections below walk you through creating an IAM user, attaching the correct permissions, and connecting to EnvManager.

How to Create an IAM User

If you already have an IAM user with the required permissions, you can skip to Connecting Your AWS Secrets Manager.

Minimal IAM Policy

Use this policy to grant only the permissions EnvManager needs:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "secretsmanager:GetSecretValue",
        "secretsmanager:CreateSecret",
        "secretsmanager:PutSecretValue",
        "secretsmanager:TagResource",
        "secretsmanager:DeleteSecret",
        "secretsmanager:RestoreSecret"
      ],
      "Resource": "arn:aws:secretsmanager:REGION:ACCOUNT_ID:secret:PROD_*"
    },
    {
      "Effect": "Allow",
      "Action": "secretsmanager:ListSecrets",
      "Resource": "*"
    }
  ]
}

Replace REGION, ACCOUNT_ID, and PROD_ with your region, account ID, and the prefix you will use in EnvManager (followed by an underscore). One prefix per environment means one Resource line per environment — list them all in the same statement.

Connecting Your AWS Secrets Manager

Configuring Your Sync

After connecting AWS Secrets Manager, you need to configure which environments sync and how secrets are named.

Syncing Variables

Automatic Syncing

If you enabled auto-sync, EnvManager will automatically push variables to AWS Secrets Manager whenever:

• You add a new variable (creates a new secret)
• You edit an existing variable's value (updates the secret)
• You delete a variable (the secret is deleted from AWS)

Changes typically appear in AWS within seconds.

Manual Syncing

You can trigger a sync manually at any time:

Secret Naming in AWS

Each EnvManager variable becomes one secret in AWS Secrets Manager. Variable names pass through unchanged — DATABASE_URL stays DATABASE_URL. If you set a prefix, it is joined to the name with an underscore:

Managing Your Connection

Updating Configuration

To change which environments sync or update the prefix:

1. Click Configure on the AWS Secrets Manager integration card
2. Make your changes
3. Click Save Configuration

The new configuration takes effect immediately for the next sync.

Disconnecting AWS Secrets Manager

To remove the AWS Secrets Manager integration:

1. Click the Disconnect button on the integration card
2. Confirm the disconnection in the dialog that appears

Reconnecting

If you disconnect and want to reconnect later:

• Click Connect again and go through the connection process
• You can use the same IAM credentials or create new access keys
• You'll need to reconfigure your environment toggles and prefix

Tips & Best Practices

Start with Manual Sync

When setting up the integration for the first time:

1. Configure with auto-sync disabled
2. Trigger a manual sync to verify secrets appear in AWS Secrets Manager
3. Confirm the secret names and values look correct in the AWS console
4. Enable auto-sync once you're confident everything is working

Use a Prefix to Namespace Your Secrets

If your AWS account already has secrets, or several EnvManager environments sync into the same account and region, keep a distinct prefix per environment (the default is the environment name). Together with the managed-by = envmanager tag this makes it obvious which secrets belong to which environment.

Rotate Access Keys Periodically

AWS recommends rotating access keys regularly. To rotate:

1. Create a new access key for the IAM user in the AWS console
2. Update the connection in EnvManager by disconnecting and reconnecting with the new key
3. Delete the old access key from the IAM user
4. Verify syncing works with the new credentials

Limit IAM Permissions

The minimal IAM policy above grants only the permissions EnvManager needs — CreateSecret, PutSecretValue, and DeleteSecret. Avoid granting broader permissions like secretsmanager:* or attaching the SecretsManagerReadWrite managed policy, which provides more access than needed.

Troubleshooting

"Access Key ID not recognized" or "Secret Access Key is wrong" during validation

Cause: The access key ID does not exist (or the IAM user was deleted), or the secret access key was copied incorrectly.

Solution:

1. Verify the access key ID starts with AKIA (for long-term credentials)
2. Make sure you copied the full secret access key when it was created
3. Check that the IAM user and the access key have not been deactivated or deleted
4. If the access key was rotated, use the new credentials
5. Re-enter the credentials in EnvManager and try validation again

"Permission denied: the IAM policy is missing secretsmanager:…"

Cause: The key is valid, but the IAM policy does not grant everything EnvManager needs. Validation reports a missing ListSecrets; a sync reports whichever action failed (for example GetSecretValue on a policy written for an older version of this guide).

Solution:

1. Open the IAM console and find the user
2. Attach the policy from Minimal IAM Policy above — all seven actions
3. Verify the policy Resource ARN matches your prefix — if the prefix is PROD, the ARN must cover arn:aws:secretsmanager:REGION:ACCOUNT_ID:secret:PROD_*
4. Check if any Service Control Policies (SCPs) in your AWS Organization are blocking access

A secret I removed and re-added shows "marked for deletion"

Cause: AWS reserves the name of a secret for its recovery window. EnvManager restores it automatically, which needs secretsmanager:RestoreSecret.

Solution: Add RestoreSecret to the policy and sync again — or wait for the recovery window to end, after which the secret is created fresh.

"Invalid region" error

Cause: The selected region is not available or the Secrets Manager service is not enabled in that region.

Solution:

1. Make sure you selected a valid AWS region from the dropdown
2. Verify Secrets Manager is available in your chosen region (it's available in all standard regions)
3. Try selecting a different region

Variables not appearing in AWS Secrets Manager

Cause: The sync may have failed, or the environment is not enabled for sync.

Solution:

1. Click Configure and verify that the relevant environments are toggled on
2. Check the sync history for error messages on the integration card
3. Trigger a manual sync and watch for errors
4. Make sure you're looking in the correct AWS region in the console

Auto-sync not triggering

Cause: Auto-sync may be disabled in the configuration, or the sync is failing silently.

Solution:

1. Click Configure and verify Auto-sync is enabled
2. Check the sync history for recent failed syncs
3. Try a manual sync to confirm the connection is still working
4. If access keys were rotated, reconnect with the new credentials

Related Topics