@aws-sdk/client-secrets-manager 3.40.0 → 3.45.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (30) hide show
  1. package/CHANGELOG.md +38 -0
  2. package/README.md +1 -1
  3. package/dist-cjs/endpoints.js +9 -0
  4. package/dist-es/endpoints.js +9 -0
  5. package/dist-types/SecretsManager.d.ts +142 -727
  6. package/dist-types/SecretsManagerClient.d.ts +1 -1
  7. package/dist-types/commands/CancelRotateSecretCommand.d.ts +8 -50
  8. package/dist-types/commands/CreateSecretCommand.d.ts +20 -88
  9. package/dist-types/commands/DeleteResourcePolicyCommand.d.ts +3 -25
  10. package/dist-types/commands/DeleteSecretCommand.d.ts +10 -43
  11. package/dist-types/commands/DescribeSecretCommand.d.ts +3 -29
  12. package/dist-types/commands/GetRandomPasswordCommand.d.ts +2 -12
  13. package/dist-types/commands/GetResourcePolicyCommand.d.ts +5 -28
  14. package/dist-types/commands/GetSecretValueCommand.d.ts +5 -26
  15. package/dist-types/commands/ListSecretVersionIdsCommand.d.ts +7 -26
  16. package/dist-types/commands/ListSecretsCommand.d.ts +8 -27
  17. package/dist-types/commands/PutResourcePolicyCommand.d.ts +5 -32
  18. package/dist-types/commands/PutSecretValueCommand.d.ts +16 -84
  19. package/dist-types/commands/RemoveRegionsFromReplicationCommand.d.ts +2 -2
  20. package/dist-types/commands/ReplicateSecretToRegionsCommand.d.ts +2 -3
  21. package/dist-types/commands/RestoreSecretCommand.d.ts +2 -19
  22. package/dist-types/commands/RotateSecretCommand.d.ts +18 -61
  23. package/dist-types/commands/StopReplicationToReplicaCommand.d.ts +3 -2
  24. package/dist-types/commands/TagResourceCommand.d.ts +9 -30
  25. package/dist-types/commands/UntagResourceCommand.d.ts +2 -22
  26. package/dist-types/commands/UpdateSecretCommand.d.ts +20 -84
  27. package/dist-types/commands/UpdateSecretVersionStageCommand.d.ts +7 -29
  28. package/dist-types/commands/ValidateResourcePolicyCommand.d.ts +6 -26
  29. package/dist-types/models/models_0.d.ts +400 -479
  30. package/package.json +6 -6
package/dist-types/commands/PutResourcePolicyCommand.d.ts CHANGED
@@ -7,38 +7,11 @@ export interface PutResourcePolicyCommandInput extends PutResourcePolicyRequest
7
7
  export interface PutResourcePolicyCommandOutput extends PutResourcePolicyResponse, __MetadataBearer {
8
8
  }
9
9
  /**
10
- * <p>Attaches the contents of the specified resource-based permission policy to a secret. A
11
- * resource-based policy is optional. Alternatively, you can use IAM identity-based policies
12
- * that specify the secret's Amazon Resource Name (ARN) in the policy statement's
13
- * <code>Resources</code> element. You can also use a combination of both identity-based and
14
- * resource-based policies. The affected users and roles receive the permissions that are
15
- * permitted by all of the relevant policies. For more information, see <a href="http://docs.aws.amazon.com/secretsmanager/latest/userguide/auth-and-access_resource-based-policies.html">Using Resource-Based
16
- * Policies for Amazon Web Services Secrets Manager</a>. For the complete description of the Amazon Web Services policy syntax and
17
- * grammar, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies.html">IAM JSON
18
- * Policy Reference</a> in the <i>IAM User Guide</i>.</p>
19
- * <p>
20
- * <b>Minimum permissions</b>
10
+ * <p>Attaches a resource-based permission policy to a secret. A resource-based policy is
11
+ * optional. For more information, see <a href="https://docs.aws.amazon.com/secretsmanager/latest/userguide/auth-and-access.html">Authentication and access control for Secrets Manager</a>
21
12
  * </p>
22
- * <p>To run this command, you must have the following permissions:</p>
23
- * <ul>
24
- * <li>
25
- * <p>secretsmanager:PutResourcePolicy</p>
26
- * </li>
27
- * </ul>
28
- * <p>
29
- * <b>Related operations</b>
30
- * </p>
31
- * <ul>
32
- * <li>
33
- * <p>To retrieve the resource policy attached to a secret, use <a>GetResourcePolicy</a>.</p>
34
- * </li>
35
- * <li>
36
- * <p>To delete the resource-based policy attached to a secret, use <a>DeleteResourcePolicy</a>.</p>
37
- * </li>
38
- * <li>
39
- * <p>To list all of the currently available secrets, use <a>ListSecrets</a>.</p>
40
- * </li>
41
- * </ul>
13
+ * <p>For information about attaching a policy in the console, see <a href="https://docs.aws.amazon.com/secretsmanager/latest/userguide/auth-and-access_resource-based-policies.html">Attach a
14
+ * permissions policy to a secret</a>.</p>
42
15
  * @example
43
16
  * Use a bare-bones client and the command you need to make an API call.
44
17
  * ```javascript
@@ -51,7 +24,7 @@ export interface PutResourcePolicyCommandOutput extends PutResourcePolicyRespons
51
24
  *
52
25
  * @see {@link PutResourcePolicyCommandInput} for command's `input` shape.
53
26
  * @see {@link PutResourcePolicyCommandOutput} for command's `response` shape.
54
- * @see {@link SecretsManagerClientResolvedConfig | config} for command's `input` shape.
27
+ * @see {@link SecretsManagerClientResolvedConfig | config} for SecretsManagerClient's `config` shape.
55
28
  *
56
29
  */
57
30
  export declare class PutResourcePolicyCommand extends $Command<PutResourcePolicyCommandInput, PutResourcePolicyCommandOutput, SecretsManagerClientResolvedConfig> {
package/dist-types/commands/PutSecretValueCommand.d.ts CHANGED
@@ -7,95 +7,27 @@ export interface PutSecretValueCommandInput extends PutSecretValueRequest {
7
7
  export interface PutSecretValueCommandOutput extends PutSecretValueResponse, __MetadataBearer {
8
8
  }
9
9
  /**
10
- * <p>Stores a new encrypted secret value in the specified secret. To do this, the operation
11
- * creates a new version and attaches it to the secret. The version can contain a new
12
- * <code>SecretString</code> value or a new <code>SecretBinary</code> value. You can also
13
- * specify the staging labels that are initially attached to the new version.</p>
10
+ * <p>Creates a new version with a new encrypted secret value and attaches it to the secret. The
11
+ * version can contain a new <code>SecretString</code> value or a new <code>SecretBinary</code> value. </p>
14
12
  * <p>We recommend you avoid calling <code>PutSecretValue</code> at a sustained rate of more than
15
13
  * once every 10 minutes. When you update the secret value, Secrets Manager creates a new version
16
14
  * of the secret. Secrets Manager removes outdated versions when there are more than 100, but it does not
17
15
  * remove versions created less than 24 hours ago. If you call <code>PutSecretValue</code> more
18
16
  * than once every 10 minutes, you create more versions than Secrets Manager removes, and you will reach
19
17
  * the quota for secret versions.</p>
20
- * <ul>
21
- * <li>
22
- * <p>If this operation creates the first version for the secret then Secrets Manager
23
- * automatically attaches the staging label <code>AWSCURRENT</code> to the new version.</p>
24
- * </li>
25
- * <li>
26
- * <p>If you do not specify a value for VersionStages then Secrets Manager automatically
27
- * moves the staging label <code>AWSCURRENT</code> to this new version.</p>
28
- * </li>
29
- * <li>
30
- * <p>If this operation moves the staging label <code>AWSCURRENT</code> from another version to this
31
- * version, then Secrets Manager also automatically moves the staging label <code>AWSPREVIOUS</code> to
32
- * the version that <code>AWSCURRENT</code> was removed from.</p>
33
- * </li>
34
- * <li>
35
- * <p>This operation is idempotent. If a version with a <code>VersionId</code> with the same
36
- * value as the <code>ClientRequestToken</code> parameter already exists and you specify the
37
- * same secret data, the operation succeeds but does nothing. However, if the secret data is
38
- * different, then the operation fails because you cannot modify an existing version; you can
39
- * only create new ones.</p>
40
- * </li>
41
- * </ul>
42
- * <note>
43
- * <ul>
44
- * <li>
45
- * <p>If you call an operation to encrypt or decrypt the <code>SecretString</code>
46
- * or <code>SecretBinary</code> for a secret in the same account as the calling user and that
47
- * secret doesn't specify a Amazon Web Services KMS encryption key, Secrets Manager uses the account's default
48
- * Amazon Web Services managed customer master key (CMK) with the alias <code>aws/secretsmanager</code>. If this key
49
- * doesn't already exist in your account then Secrets Manager creates it for you automatically. All
50
- * users and roles in the same Amazon Web Services account automatically have access to use the default CMK.
51
- * Note that if an Secrets Manager API call results in Amazon Web Services creating the account's
52
- * Amazon Web Services-managed CMK, it can result in a one-time significant delay in returning the
53
- * result.</p>
54
- * </li>
55
- * <li>
56
- * <p>If the secret resides in a different Amazon Web Services account from the credentials calling an API that
57
- * requires encryption or decryption of the secret value then you must create and use a custom
58
- * Amazon Web Services KMS CMK because you can't access the default CMK for the account using credentials
59
- * from a different Amazon Web Services account. Store the ARN of the CMK in the secret when you create the
60
- * secret or when you update it by including it in the <code>KMSKeyId</code>. If you call an
61
- * API that must encrypt or decrypt <code>SecretString</code> or <code>SecretBinary</code>
62
- * using credentials from a different account then the Amazon Web Services KMS key policy must grant cross-account
63
- * access to that other account's user or role for both the kms:GenerateDataKey and
64
- * kms:Decrypt operations.</p>
65
- * </li>
66
- * </ul>
67
- * </note>
68
- * <p>
69
- * <b>Minimum permissions</b>
70
- * </p>
71
- * <p>To run this command, you must have the following permissions:</p>
72
- * <ul>
73
- * <li>
74
- * <p>secretsmanager:PutSecretValue</p>
75
- * </li>
76
- * <li>
77
- * <p>kms:GenerateDataKey - needed only if you use a customer-managed Amazon Web Services KMS key to encrypt
78
- * the secret. You do not need this permission to use the account's default Amazon Web Services managed CMK
79
- * for Secrets Manager.</p>
80
- * </li>
81
- * </ul>
82
- * <p>
83
- * <b>Related operations</b>
84
- * </p>
85
- * <ul>
86
- * <li>
87
- * <p>To retrieve the encrypted value you store in the version of a secret, use <a>GetSecretValue</a>.</p>
88
- * </li>
89
- * <li>
90
- * <p>To create a secret, use <a>CreateSecret</a>.</p>
91
- * </li>
92
- * <li>
93
- * <p>To get the details for a secret, use <a>DescribeSecret</a>.</p>
94
- * </li>
95
- * <li>
96
- * <p>To list the versions attached to a secret, use <a>ListSecretVersionIds</a>.</p>
97
- * </li>
98
- * </ul>
18
+ * <p>You can specify the staging labels to attach to the new version in <code>VersionStages</code>.
19
+ * If you don't include <code>VersionStages</code>, then Secrets Manager automatically
20
+ * moves the staging label <code>AWSCURRENT</code> to this version. If this operation creates
21
+ * the first version for the secret, then Secrets Manager
22
+ * automatically attaches the staging label <code>AWSCURRENT</code> to it .</p>
23
+ * <p>If this operation moves the staging label <code>AWSCURRENT</code> from another version to this
24
+ * version, then Secrets Manager also automatically moves the staging label <code>AWSPREVIOUS</code> to
25
+ * the version that <code>AWSCURRENT</code> was removed from.</p>
26
+ * <p>This operation is idempotent. If a version with a <code>VersionId</code> with the same
27
+ * value as the <code>ClientRequestToken</code> parameter already exists, and you specify the
28
+ * same secret data, the operation succeeds but does nothing. However, if the secret data is
29
+ * different, then the operation fails because you can't modify an existing version; you can
30
+ * only create new ones.</p>
99
31
  * @example
100
32
  * Use a bare-bones client and the command you need to make an API call.
101
33
  * ```javascript
@@ -108,7 +40,7 @@ export interface PutSecretValueCommandOutput extends PutSecretValueResponse, __M
108
40
  *
109
41
  * @see {@link PutSecretValueCommandInput} for command's `input` shape.
110
42
  * @see {@link PutSecretValueCommandOutput} for command's `response` shape.
111
- * @see {@link SecretsManagerClientResolvedConfig | config} for command's `input` shape.
43
+ * @see {@link SecretsManagerClientResolvedConfig | config} for SecretsManagerClient's `config` shape.
112
44
  *
113
45
  */
114
46
  export declare class PutSecretValueCommand extends $Command<PutSecretValueCommandInput, PutSecretValueCommandOutput, SecretsManagerClientResolvedConfig> {
package/dist-types/commands/RemoveRegionsFromReplicationCommand.d.ts CHANGED
@@ -7,7 +7,7 @@ export interface RemoveRegionsFromReplicationCommandInput extends RemoveRegionsF
7
7
  export interface RemoveRegionsFromReplicationCommandOutput extends RemoveRegionsFromReplicationResponse, __MetadataBearer {
8
8
  }
9
9
  /**
10
- * <p>Remove regions from replication.</p>
10
+ * <p>For a secret that is replicated to other Regions, deletes the secret replicas from the Regions you specify.</p>
11
11
  * @example
12
12
  * Use a bare-bones client and the command you need to make an API call.
13
13
  * ```javascript
@@ -20,7 +20,7 @@ export interface RemoveRegionsFromReplicationCommandOutput extends RemoveRegions
20
20
  *
21
21
  * @see {@link RemoveRegionsFromReplicationCommandInput} for command's `input` shape.
22
22
  * @see {@link RemoveRegionsFromReplicationCommandOutput} for command's `response` shape.
23
- * @see {@link SecretsManagerClientResolvedConfig | config} for command's `input` shape.
23
+ * @see {@link SecretsManagerClientResolvedConfig | config} for SecretsManagerClient's `config` shape.
24
24
  *
25
25
  */
26
26
  export declare class RemoveRegionsFromReplicationCommand extends $Command<RemoveRegionsFromReplicationCommandInput, RemoveRegionsFromReplicationCommandOutput, SecretsManagerClientResolvedConfig> {
package/dist-types/commands/ReplicateSecretToRegionsCommand.d.ts CHANGED
@@ -7,8 +7,7 @@ export interface ReplicateSecretToRegionsCommandInput extends ReplicateSecretToR
7
7
  export interface ReplicateSecretToRegionsCommandOutput extends ReplicateSecretToRegionsResponse, __MetadataBearer {
8
8
  }
9
9
  /**
10
- * <p>Converts an existing secret to a multi-Region secret and begins replication the secret to a
11
- * list of new regions. </p>
10
+ * <p>Replicates the secret to a new Regions. See <a href="https://docs.aws.amazon.com/secretsmanager/latest/userguide/create-manage-multi-region-secrets.html">Multi-Region secrets</a>.</p>
12
11
  * @example
13
12
  * Use a bare-bones client and the command you need to make an API call.
14
13
  * ```javascript
@@ -21,7 +20,7 @@ export interface ReplicateSecretToRegionsCommandOutput extends ReplicateSecretTo
21
20
  *
22
21
  * @see {@link ReplicateSecretToRegionsCommandInput} for command's `input` shape.
23
22
  * @see {@link ReplicateSecretToRegionsCommandOutput} for command's `response` shape.
24
- * @see {@link SecretsManagerClientResolvedConfig | config} for command's `input` shape.
23
+ * @see {@link SecretsManagerClientResolvedConfig | config} for SecretsManagerClient's `config` shape.
25
24
  *
26
25
  */
27
26
  export declare class ReplicateSecretToRegionsCommand extends $Command<ReplicateSecretToRegionsCommandInput, ReplicateSecretToRegionsCommandOutput, SecretsManagerClientResolvedConfig> {
package/dist-types/commands/RestoreSecretCommand.d.ts CHANGED
@@ -8,24 +8,7 @@ export interface RestoreSecretCommandOutput extends RestoreSecretResponse, __Met
8
8
  }
9
9
  /**
10
10
  * <p>Cancels the scheduled deletion of a secret by removing the <code>DeletedDate</code> time
11
- * stamp. This makes the secret accessible to query once again.</p>
12
- * <p>
13
- * <b>Minimum permissions</b>
14
- * </p>
15
- * <p>To run this command, you must have the following permissions:</p>
16
- * <ul>
17
- * <li>
18
- * <p>secretsmanager:RestoreSecret</p>
19
- * </li>
20
- * </ul>
21
- * <p>
22
- * <b>Related operations</b>
23
- * </p>
24
- * <ul>
25
- * <li>
26
- * <p>To delete a secret, use <a>DeleteSecret</a>.</p>
27
- * </li>
28
- * </ul>
11
+ * stamp. You can access a secret again after it has been restored.</p>
29
12
  * @example
30
13
  * Use a bare-bones client and the command you need to make an API call.
31
14
  * ```javascript
@@ -38,7 +21,7 @@ export interface RestoreSecretCommandOutput extends RestoreSecretResponse, __Met
38
21
  *
39
22
  * @see {@link RestoreSecretCommandInput} for command's `input` shape.
40
23
  * @see {@link RestoreSecretCommandOutput} for command's `response` shape.
41
- * @see {@link SecretsManagerClientResolvedConfig | config} for command's `input` shape.
24
+ * @see {@link SecretsManagerClientResolvedConfig | config} for SecretsManagerClient's `config` shape.
42
25
  *
43
26
  */
44
27
  export declare class RestoreSecretCommand extends $Command<RestoreSecretCommandInput, RestoreSecretCommandOutput, SecretsManagerClientResolvedConfig> {
package/dist-types/commands/RotateSecretCommand.d.ts CHANGED
@@ -7,68 +7,25 @@ export interface RotateSecretCommandInput extends RotateSecretRequest {
7
7
  export interface RotateSecretCommandOutput extends RotateSecretResponse, __MetadataBearer {
8
8
  }
9
9
  /**
10
- * <p>Configures and starts the asynchronous process of rotating this secret. If you include the
11
- * configuration parameters, the operation sets those values for the secret and then immediately
12
- * starts a rotation. If you do not include the configuration parameters, the operation starts a
13
- * rotation with the values already stored in the secret. After the rotation completes, the
14
- * protected service and its clients all use the new version of the secret. </p>
15
- * <p>This required configuration information includes the ARN of an Amazon Web Services Lambda function and
16
- * optionally, the time between scheduled rotations. The Lambda rotation function creates a new
17
- * version of the secret and creates or updates the credentials on the protected service to
18
- * match. After testing the new credentials, the function marks the new secret with the staging
19
- * label <code>AWSCURRENT</code> so that your clients all immediately begin to use the new version. For more
20
- * information about rotating secrets and how to configure a Lambda function to rotate the
21
- * secrets for your protected service, see <a href="https://docs.aws.amazon.com/secretsmanager/latest/userguide/rotating-secrets.html">Rotating Secrets in Amazon Web Services Secrets Manager</a> in the
22
- * <i>Amazon Web Services Secrets Manager User Guide</i>.</p>
23
- * <p>Secrets Manager schedules the next rotation when the previous
24
- * one completes. Secrets Manager schedules the date by adding the rotation interval (number of days) to the
25
- * actual date of the last rotation. The service chooses the hour within that 24-hour date window
26
- * randomly. The minute is also chosen somewhat randomly, but weighted towards the top of the hour
27
- * and influenced by a variety of factors that help distribute load.</p>
28
- * <p>The
29
- * rotation function must end with the versions of the secret in one of two states:</p>
30
- * <ul>
31
- * <li>
32
- * <p>The <code>AWSPENDING</code> and <code>AWSCURRENT</code> staging labels are attached to the same version of
33
- * the secret, or</p>
34
- * </li>
35
- * <li>
36
- * <p>The <code>AWSPENDING</code> staging label is not attached to any version of the secret.</p>
37
- * </li>
38
- * </ul>
10
+ * <p>Configures and starts the asynchronous process of rotating the secret.</p>
11
+ * <p>If you include the
12
+ * configuration parameters, the operation sets the values for the secret and then immediately
13
+ * starts a rotation. If you don't include the configuration parameters, the operation starts a
14
+ * rotation with the values already stored in the secret. For more information about rotation,
15
+ * see <a href="https://docs.aws.amazon.com/secretsmanager/latest/userguide/rotating-secrets.html">Rotate secrets</a>.</p>
16
+ * <p>To configure rotation, you include the ARN of an Amazon Web Services Lambda function and the schedule
17
+ * for the rotation. The Lambda rotation function creates a new
18
+ * version of the secret and creates or updates the credentials on the database or service to
19
+ * match. After testing the new credentials, the function marks the new secret version with the staging
20
+ * label <code>AWSCURRENT</code>. Then anyone who retrieves the secret gets the new version. For more
21
+ * information, see <a href="https://docs.aws.amazon.com/secretsmanager/latest/userguide/rotate-secrets_how.html">How rotation works</a>.</p>
22
+ * <p>When rotation is successful, the <code>AWSPENDING</code> staging label might be attached to the same
23
+ * version as the <code>AWSCURRENT</code> version, or it might not be attached to any version.</p>
39
24
  * <p>If the <code>AWSPENDING</code> staging label is present but not attached to the same version as
40
- * <code>AWSCURRENT</code> then any later invocation of <code>RotateSecret</code> assumes that a previous
25
+ * <code>AWSCURRENT</code>, then any later invocation of <code>RotateSecret</code> assumes that a previous
41
26
  * rotation request is still in progress and returns an error.</p>
42
- * <p>
43
- * <b>Minimum permissions</b>
44
- * </p>
45
- * <p>To run this command, you must have the following permissions:</p>
46
- * <ul>
47
- * <li>
48
- * <p>secretsmanager:RotateSecret</p>
49
- * </li>
50
- * <li>
51
- * <p>lambda:InvokeFunction (on the function specified in the secret's metadata)</p>
52
- * </li>
53
- * </ul>
54
- * <p>
55
- * <b>Related operations</b>
56
- * </p>
57
- * <ul>
58
- * <li>
59
- * <p>To list the secrets in your account, use <a>ListSecrets</a>.</p>
60
- * </li>
61
- * <li>
62
- * <p>To get the details for a version of a secret, use <a>DescribeSecret</a>.</p>
63
- * </li>
64
- * <li>
65
- * <p>To create a new version of a secret, use <a>CreateSecret</a>.</p>
66
- * </li>
67
- * <li>
68
- * <p>To attach staging labels to or remove staging labels from a version of a secret, use
69
- * <a>UpdateSecretVersionStage</a>.</p>
70
- * </li>
71
- * </ul>
27
+ * <p>To run this command, you must have <code>secretsmanager:RotateSecret</code> permissions and
28
+ * <code>lambda:InvokeFunction</code> permissions on the function specified in the secret's metadata.</p>
72
29
  * @example
73
30
  * Use a bare-bones client and the command you need to make an API call.
74
31
  * ```javascript
@@ -81,7 +38,7 @@ export interface RotateSecretCommandOutput extends RotateSecretResponse, __Metad
81
38
  *
82
39
  * @see {@link RotateSecretCommandInput} for command's `input` shape.
83
40
  * @see {@link RotateSecretCommandOutput} for command's `response` shape.
84
- * @see {@link SecretsManagerClientResolvedConfig | config} for command's `input` shape.
41
+ * @see {@link SecretsManagerClientResolvedConfig | config} for SecretsManagerClient's `config` shape.
85
42
  *
86
43
  */
87
44
  export declare class RotateSecretCommand extends $Command<RotateSecretCommandInput, RotateSecretCommandOutput, SecretsManagerClientResolvedConfig> {
package/dist-types/commands/StopReplicationToReplicaCommand.d.ts CHANGED
@@ -7,7 +7,8 @@ export interface StopReplicationToReplicaCommandInput extends StopReplicationToR
7
7
  export interface StopReplicationToReplicaCommandOutput extends StopReplicationToReplicaResponse, __MetadataBearer {
8
8
  }
9
9
  /**
10
- * <p>Removes the secret from replication and promotes the secret to a regional secret in the replica Region.</p>
10
+ * <p>Removes the link between the replica secret and the primary secret and promotes the replica to a primary secret in the replica Region.</p>
11
+ * <p>You must call this operation from the Region in which you want to promote the replica to a primary secret.</p>
11
12
  * @example
12
13
  * Use a bare-bones client and the command you need to make an API call.
13
14
  * ```javascript
@@ -20,7 +21,7 @@ export interface StopReplicationToReplicaCommandOutput extends StopReplicationTo
20
21
  *
21
22
  * @see {@link StopReplicationToReplicaCommandInput} for command's `input` shape.
22
23
  * @see {@link StopReplicationToReplicaCommandOutput} for command's `response` shape.
23
- * @see {@link SecretsManagerClientResolvedConfig | config} for command's `input` shape.
24
+ * @see {@link SecretsManagerClientResolvedConfig | config} for SecretsManagerClient's `config` shape.
24
25
  *
25
26
  */
26
27
  export declare class StopReplicationToReplicaCommand extends $Command<StopReplicationToReplicaCommandInput, StopReplicationToReplicaCommandOutput, SecretsManagerClientResolvedConfig> {
package/dist-types/commands/TagResourceCommand.d.ts CHANGED
@@ -7,20 +7,18 @@ export interface TagResourceCommandInput extends TagResourceRequest {
7
7
  export interface TagResourceCommandOutput extends __MetadataBearer {
8
8
  }
9
9
  /**
10
- * <p>Attaches one or more tags, each consisting of a key name and a value, to the specified
11
- * secret. Tags are part of the secret's overall metadata, and are not associated with any
12
- * specific version of the secret. This operation only appends tags to the existing list of tags.
13
- * To remove tags, you must use <a>UntagResource</a>.</p>
14
- * <p>The following basic restrictions apply to tags:</p>
10
+ * <p>Attaches tags to a secret. Tags consist of a key name and a value. Tags are part of the
11
+ * secret's metadata. They are not associated with specific versions of the secret. This operation appends tags to the existing list of tags.</p>
12
+ * <p>The following restrictions apply to tags:</p>
15
13
  * <ul>
16
14
  * <li>
17
- * <p>Maximum number of tags per secret—50</p>
15
+ * <p>Maximum number of tags per secret: 50</p>
18
16
  * </li>
19
17
  * <li>
20
- * <p>Maximum key length—127 Unicode characters in UTF-8</p>
18
+ * <p>Maximum key length: 127 Unicode characters in UTF-8</p>
21
19
  * </li>
22
20
  * <li>
23
- * <p>Maximum value length—255 Unicode characters in UTF-8</p>
21
+ * <p>Maximum value length: 255 Unicode characters in UTF-8</p>
24
22
  * </li>
25
23
  * <li>
26
24
  * <p>Tag keys and values are case sensitive.</p>
@@ -32,37 +30,18 @@ export interface TagResourceCommandOutput extends __MetadataBearer {
32
30
  * </li>
33
31
  * <li>
34
32
  * <p>If you use your tagging schema across multiple services and resources,
35
- * remember other services might have restrictions on allowed characters. Generally
33
+ * other services might have restrictions on allowed characters. Generally
36
34
  * allowed characters: letters, spaces, and numbers representable in UTF-8, plus the
37
35
  * following special characters: + - = . _ : / @.</p>
38
36
  * </li>
39
37
  * </ul>
38
+ *
40
39
  * <important>
41
40
  * <p>If you use tags as part of your security strategy, then adding or removing a tag can
42
41
  * change permissions. If successfully completing this operation would result in you losing
43
42
  * your permissions for this secret, then the operation is blocked and returns an Access Denied
44
43
  * error.</p>
45
44
  * </important>
46
- * <p>
47
- * <b>Minimum permissions</b>
48
- * </p>
49
- * <p>To run this command, you must have the following permissions:</p>
50
- * <ul>
51
- * <li>
52
- * <p>secretsmanager:TagResource</p>
53
- * </li>
54
- * </ul>
55
- * <p>
56
- * <b>Related operations</b>
57
- * </p>
58
- * <ul>
59
- * <li>
60
- * <p>To remove one or more tags from the collection attached to a secret, use <a>UntagResource</a>.</p>
61
- * </li>
62
- * <li>
63
- * <p>To view the list of tags attached to a secret, use <a>DescribeSecret</a>.</p>
64
- * </li>
65
- * </ul>
66
45
  * @example
67
46
  * Use a bare-bones client and the command you need to make an API call.
68
47
  * ```javascript
@@ -75,7 +54,7 @@ export interface TagResourceCommandOutput extends __MetadataBearer {
75
54
  *
76
55
  * @see {@link TagResourceCommandInput} for command's `input` shape.
77
56
  * @see {@link TagResourceCommandOutput} for command's `response` shape.
78
- * @see {@link SecretsManagerClientResolvedConfig | config} for command's `input` shape.
57
+ * @see {@link SecretsManagerClientResolvedConfig | config} for SecretsManagerClient's `config` shape.
79
58
  *
80
59
  */
81
60
  export declare class TagResourceCommand extends $Command<TagResourceCommandInput, TagResourceCommandOutput, SecretsManagerClientResolvedConfig> {
package/dist-types/commands/UntagResourceCommand.d.ts CHANGED
@@ -7,7 +7,7 @@ export interface UntagResourceCommandInput extends UntagResourceRequest {
7
7
  export interface UntagResourceCommandOutput extends __MetadataBearer {
8
8
  }
9
9
  /**
10
- * <p>Removes one or more tags from the specified secret.</p>
10
+ * <p>Removes specific tags from a secret.</p>
11
11
  * <p>This operation is idempotent. If a requested tag is not attached to the secret, no error
12
12
  * is returned and the secret metadata is unchanged.</p>
13
13
  * <important>
@@ -16,26 +16,6 @@ export interface UntagResourceCommandOutput extends __MetadataBearer {
16
16
  * permissions for this secret, then the operation is blocked and returns an Access Denied
17
17
  * error.</p>
18
18
  * </important>
19
- * <p>
20
- * <b>Minimum permissions</b>
21
- * </p>
22
- * <p>To run this command, you must have the following permissions:</p>
23
- * <ul>
24
- * <li>
25
- * <p>secretsmanager:UntagResource</p>
26
- * </li>
27
- * </ul>
28
- * <p>
29
- * <b>Related operations</b>
30
- * </p>
31
- * <ul>
32
- * <li>
33
- * <p>To add one or more tags to the collection attached to a secret, use <a>TagResource</a>.</p>
34
- * </li>
35
- * <li>
36
- * <p>To view the list of tags attached to a secret, use <a>DescribeSecret</a>.</p>
37
- * </li>
38
- * </ul>
39
19
  * @example
40
20
  * Use a bare-bones client and the command you need to make an API call.
41
21
  * ```javascript
@@ -48,7 +28,7 @@ export interface UntagResourceCommandOutput extends __MetadataBearer {
48
28
  *
49
29
  * @see {@link UntagResourceCommandInput} for command's `input` shape.
50
30
  * @see {@link UntagResourceCommandOutput} for command's `response` shape.
51
- * @see {@link SecretsManagerClientResolvedConfig | config} for command's `input` shape.
31
+ * @see {@link SecretsManagerClientResolvedConfig | config} for SecretsManagerClient's `config` shape.
52
32
  *
53
33
  */
54
34
  export declare class UntagResourceCommand extends $Command<UntagResourceCommandInput, UntagResourceCommandOutput, SecretsManagerClientResolvedConfig> {
package/dist-types/commands/UpdateSecretCommand.d.ts CHANGED
@@ -7,10 +7,8 @@ export interface UpdateSecretCommandInput extends UpdateSecretRequest {
7
7
  export interface UpdateSecretCommandOutput extends UpdateSecretResponse, __MetadataBearer {
8
8
  }
9
9
  /**
10
- * <p>Modifies many of the details of the specified secret. </p>
11
- * <p>To change the secret value, you can also use <a>PutSecretValue</a>.</p>
12
- * <p>To change the rotation configuration of a secret, use <a>RotateSecret</a>
13
- * instead.</p>
10
+ * <p>Modifies the details of a secret, including metadata and the secret value. To change the secret value, you can also use <a>PutSecretValue</a>.</p>
11
+ * <p>To change the rotation configuration of a secret, use <a>RotateSecret</a> instead.</p>
14
12
  *
15
13
  * <p>We recommend you avoid calling <code>UpdateSecret</code> at a sustained rate of more than
16
14
  * once every 10 minutes. When you call <code>UpdateSecret</code> to update the secret value, Secrets Manager creates a new version
@@ -18,85 +16,23 @@ export interface UpdateSecretCommandOutput extends UpdateSecretResponse, __Metad
18
16
  * remove versions created less than 24 hours ago. If you update the secret value more
19
17
  * than once every 10 minutes, you create more versions than Secrets Manager removes, and you will reach
20
18
  * the quota for secret versions.</p>
21
- * <note>
22
- * <p>The Secrets Manager console uses only the <code>SecretString</code> parameter and therefore limits
23
- * you to encrypting and storing only a text string. To encrypt and store binary data as part
24
- * of the version of a secret, you must use either the Amazon Web Services CLI or one of the Amazon Web Services
25
- * SDKs.</p>
26
- * </note>
27
- * <ul>
28
- * <li>
29
- * <p>If a version with a <code>VersionId</code> with the same value as the
30
- * <code>ClientRequestToken</code> parameter already exists, the operation results in an
31
- * error. You cannot modify an existing version, you can only create a new version.</p>
32
- * </li>
33
- * <li>
34
- * <p>If you include <code>SecretString</code> or <code>SecretBinary</code> to create a new
35
- * secret version, Secrets Manager automatically attaches the staging label <code>AWSCURRENT</code> to the new
36
- * version. </p>
37
- * </li>
38
- * </ul>
39
- * <note>
40
- * <ul>
41
- * <li>
42
- * <p>If you call an operation to encrypt or decrypt the <code>SecretString</code>
43
- * or <code>SecretBinary</code> for a secret in the same account as the calling user and that
44
- * secret doesn't specify a Amazon Web Services KMS encryption key, Secrets Manager uses the account's default
45
- * Amazon Web Services managed customer master key (CMK) with the alias <code>aws/secretsmanager</code>. If this key
46
- * doesn't already exist in your account then Secrets Manager creates it for you automatically. All
47
- * users and roles in the same Amazon Web Services account automatically have access to use the default CMK.
48
- * Note that if an Secrets Manager API call results in Amazon Web Services creating the account's
49
- * Amazon Web Services-managed CMK, it can result in a one-time significant delay in returning the
50
- * result.</p>
51
- * </li>
52
- * <li>
53
- * <p>If the secret resides in a different Amazon Web Services account from the credentials calling an API that
54
- * requires encryption or decryption of the secret value then you must create and use a custom
55
- * Amazon Web Services KMS CMK because you can't access the default CMK for the account using credentials
56
- * from a different Amazon Web Services account. Store the ARN of the CMK in the secret when you create the
57
- * secret or when you update it by including it in the <code>KMSKeyId</code>. If you call an
58
- * API that must encrypt or decrypt <code>SecretString</code> or <code>SecretBinary</code>
59
- * using credentials from a different account then the Amazon Web Services KMS key policy must grant cross-account
60
- * access to that other account's user or role for both the kms:GenerateDataKey and
61
- * kms:Decrypt operations.</p>
62
- * </li>
63
- * </ul>
64
- * </note>
65
- * <p>
66
- * <b>Minimum permissions</b>
67
- * </p>
68
- * <p>To run this command, you must have the following permissions:</p>
69
- * <ul>
70
- * <li>
71
- * <p>secretsmanager:UpdateSecret</p>
72
- * </li>
73
- * <li>
74
- * <p>kms:GenerateDataKey - needed only if you use a custom Amazon Web Services KMS key to encrypt the secret.
75
- * You do not need this permission to use the account's Amazon Web Services managed CMK for
76
- * Secrets Manager.</p>
77
- * </li>
78
- * <li>
79
- * <p>kms:Decrypt - needed only if you use a custom Amazon Web Services KMS key to encrypt the secret. You do
80
- * not need this permission to use the account's Amazon Web Services managed CMK for Secrets Manager.</p>
81
- * </li>
82
- * </ul>
83
- * <p>
84
- * <b>Related operations</b>
85
- * </p>
86
- * <ul>
87
- * <li>
88
- * <p>To create a new secret, use <a>CreateSecret</a>.</p>
89
- * </li>
90
- * <li>
91
- * <p>To add only a new version to an existing secret, use <a>PutSecretValue</a>.</p>
92
- * </li>
93
- * <li>
94
- * <p>To get the details for a secret, use <a>DescribeSecret</a>.</p>
95
- * </li>
96
- * <li>
97
- * <p>To list the versions contained in a secret, use <a>ListSecretVersionIds</a>.</p>
98
- * </li>
99
- * </ul>
19
+ * <p>If you include <code>SecretString</code> or <code>SecretBinary</code> to create a new
20
+ * secret version, Secrets Manager automatically attaches the staging label <code>AWSCURRENT</code> to the new
21
+ * version. </p>
22
+ * <p>If you call this operation with a <code>VersionId</code> that matches an existing version's
23
+ * <code>ClientRequestToken</code>, the operation results in an error. You can't modify an existing
24
+ * version, you can only create a new version. To remove a version, remove all staging labels from it. See
25
+ * <a>UpdateSecretVersionStage</a>.</p>
26
+ * <p>If you don't specify an KMS encryption key, Secrets Manager uses the Amazon Web Services managed key
27
+ * <code>aws/secretsmanager</code>. If this key doesn't already exist in your account, then Secrets Manager
28
+ * creates it for you automatically. All users and roles in the Amazon Web Services account automatically have access
29
+ * to use <code>aws/secretsmanager</code>. Creating <code>aws/secretsmanager</code> can result in a one-time
30
+ * significant delay in returning the result. </p>
31
+ * <p>If the secret is in a different Amazon Web Services account from the credentials calling the API, then you can't
32
+ * use <code>aws/secretsmanager</code> to encrypt the secret, and you must create and use a customer managed key. </p>
33
+ *
34
+ * <p>To run this command, you must have <code>secretsmanager:UpdateSecret</code> permissions. If you use a
35
+ * customer managed key, you must also have <code>kms:GenerateDataKey</code> and <code>kms:Decrypt</code> permissions .</p>
100
36
  * @example
101
37
  * Use a bare-bones client and the command you need to make an API call.
102
38
  * ```javascript
@@ -109,7 +45,7 @@ export interface UpdateSecretCommandOutput extends UpdateSecretResponse, __Metad
109
45
  *
110
46
  * @see {@link UpdateSecretCommandInput} for command's `input` shape.
111
47
  * @see {@link UpdateSecretCommandOutput} for command's `response` shape.
112
- * @see {@link SecretsManagerClientResolvedConfig | config} for command's `input` shape.
48
+ * @see {@link SecretsManagerClientResolvedConfig | config} for SecretsManagerClient's `config` shape.
113
49
  *
114
50
  */
115
51
  export declare class UpdateSecretCommand extends $Command<UpdateSecretCommandInput, UpdateSecretCommandOutput, SecretsManagerClientResolvedConfig> {