AWS Secrets Manager Credential Provider Secret Path Expressions

Use the path expressions listed in this topic to use the AWS Secrets Manager credential providers in your source authentication configurations.

The AWS Secrets Manager Credential Provider can provide any field supported by AWS Secrets Manager, such as username and password secrets.

Username

Path syntax: {Secret ARN}/{secretKey}

For example:

Before Encoding

Using Secret ARN:

secrets://aws-vault/arn:aws:secretsmanager:us-east-1:441113549707:secret:orgName/cred/applicationName/directoryName/username

Important

The URL path should always start with the prefix, secrets://. Each attribute in the URL path must be URL-encoded. Each URL attribute in the path is case-sensitive.

After Encoding

After you encode the URL path, it should appear as follows:

Using Secret ARN:

secrets://aws-vault/arn%3Aaws%3Asecretsmanager%3Aus-east-1%3A441113549707%3Asecret%3AorgName%2Fcred%2FapplicationName%2FdirectoryName/username

The following is an explanation of the attributes of this URL:

aws-vault - Configured Credential Provider in the Credential Provider Section.
arn:aws:secretsmanager:us-east-1:441113549707:secret:orgName/cred/applicationName/directoryName - Secret Path ARN.
username - Secret Key which needs to be fetched from the AWS Secrets Manager.

Tip

Use urlencoder.org to encode your URL attributes.

Password

Path syntax: {Secret ARN}/{secretKey}

For example:

Before Encoding

Using Secret ARN:

secrets://aws-vault/arn:aws:secretsmanager:us-east-1:441113549707:secret:orgName/cred/applicationName/directoryName/password

Important

The URL path should always start with the prefix, secrets://. Each attribute in the URL path must be URL-encoded. Each URL attribute in the path is case-sensitive.

After Encoding

After you encode the URL path, it should appear as follows:

Using Secret ARN:

secrets://aws-vault/arn%3Aaws%3Asecretsmanager%3Aus-east-1%3A441113549707%3Asecret%3AorgName%2Fcred%2FapplicationName%2FdirectoryName/password

The following is an explanation of the components of this URL:

aws-vault - Configured Credential Provider in the Credential Provider Section.
arn:aws:secretsmanager:us-east-1:441113549707:secret:orgName/cred/applicationName/directoryName - Secret Path ARN.
password - Secret Key which needs to be fetched from the AWS Secrets Manager.

Tip

Use urlencoder.org to encode your URL attributes.

Prefixes and Suffixes

If any secret paths have a prefix or a suffix, you must append a query parameter to the secret path as follows:

To add a prefix - ?prefix=<prefix>. For example, if the secret value returned after evaluation is LocalAdmin, but the complete value required by the secret field is DomainOne\LocalAdmin then the secret path expression will be as follows to add the required prefix:
```
secrets://aws-vault/arn%3Aaws%3Asecretsmanager%3Aus-east-1%3A441113549707%3Asecret%3AorgName%2Fcred%2FapplicationName%2FdirectoryName/password?prefix=DomainOne%5C
```
To add a suffix - ?suffix=<suffix>. For example, if the secret value returned after evaluation is localadministrator, but the complete value required by the secret field is localadminstrator@sp.com then the secret path expression will be as follows to add the required suffix:
```
secrets://aws-vault/arn:aws:secretsmanager:us-east-1:441113549707:secret:orgName/cred/applicationName/directoryName/password?suffix=%40sp.com
```
To add a prefix and suffix - ?prefix=<prefix>&suffix=<suffix>. For example, if the secret value returned after evaluation is LocalAdmin, but the complete value required by the secret field is DomainOne\LocalAdmin@sp.com then the secret path expression will be as follows to add the required prefix and suffix:
```
secrets://aws-vault/arn:aws:secretsmanager:us-east-1:441113549707:secret:orgName/cred/applicationName/directoryName/password?prefix=DomainOne%5C&suffix=%40sp.com
```

Important

All input parameters must be encoded.

Standard format for credential path:

secrets://{vault-name}/{secret ARN}/{secretKey}?prefix=someValue&suffix=someValue2&versionId=123&versionStage=PREVIOUS

Important

Prefix, suffix, versionId, and versionStage are optional.

The AWS Secrets Manager has provision to store secrets in two ways:

In key value / JSON / map format.
Plain text format.

Note

For secrets which are stored in plain text format, there is no need to provide the secret key in the credential path.

For example:

Before Encoding

Using Secret ARN:

secrets://aws-vault/arn:aws:secretsmanager:us-east-1:441113549707:secret:orgName/cred/applicationName/directoryName

Important

The URL path should always start with the prefix, secrets://. Each attribute in the URL path must be URL-encoded. Each URL attribute in the path is case-sensitive.

After Encoding

After you encode the URL path, it should appear as follows:

Using Secret ARN:

secrets://aws-vault/arn%3Aaws%3Asecretsmanager%3Aus-east-1%3A441113549707%3Asecret%3AorgName%2Fcred%2FapplicationName%2FdirectoryName

Other Query Parameters

versionId - The unique identifier of the version of the secret to retrieve. If you include both this parameter and versionStage, the two parameters must refer to the same secret version. If you don't specify both versionStage and versionId, then Secrets Manager returns the AWSCURRENT version.

Example:
```
secrets://aws-vault/arn%3Aaws%3Asecretsmanager%3Aus-east-1%3A441113549707%3Asecret%3AorgName%2Fcred%2FapplicationName%2FdirectoryName/password?versionId=123
```
versionStage - The staging label of the version of the secret to retrieve. Secrets Manager uses staging labels to keep track of different versions during the rotation process. If you include both this parameter and versionId, the two parameters must refer to the same secret version. If you don't specify both versionStage and versionId, Secrets Manager returns the AWSCURRENT version.

Example:
```
secrets://aws-vault/arn%3Aaws%3Asecretsmanager%3Aus-east-1%3A441113549707%3Asecret%3AorgName%2Fcred%2FapplicationName%2FdirectoryName/password?versionStage=AWSCURRENT
```
versionId and versionStage - If you include both the versionStage and versionId parameters, the two parameters must refer to the same secret version. If you don't specify both versionStage and versionId, Secrets Manager returns the AWSCURRENT version.

Example:
```
secrets://aws-vault/arn%3Aaws%3Asecretsmanager%3Aus-east-1%3A441113549707%3Asecret%3AorgName%2Fcred%2FapplicationName%2FdirectoryName/password?versionId=123&versionStage=AWSCURRENT
```

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.