Resource definition
What this resource looks like
This is the CUE shape a Praxis template uses to declare a SecretsManagerSecret. The resource key is local to the template; metadata.name supplies its stable Praxis identity.
resources: {
credentials: {
apiVersion: "praxis.io/alpha"
kind: "SecretsManagerSecret"
metadata: name: "\(variables.name)/bootstrap"
spec: {
region: variables.region
description: "Bootstrap credential managed by Praxis"
secretString: variables.bootstrapSecret
tags: _tags
}
}
}Excerpted from examples/stacks/foundation-services.cue. Open the complete example for its variables and related resources.
Desired state
Configuration
The spec block accepts 6 fields. 3 are required by the schema; fields with defaults can be omitted.
regionRequiredRegion.
stringdescriptionOptionalDescription.
stringkmsKeyIdOptionalkmsKeyId is the KMS key used to encrypt the secret value; when omitted, the account default key (alias/aws/secretsmanager) is used.
stringsecretStringRequiredsecretString is the sensitive secret value. It is never emitted as an output; reference it with a sensitivity-aware resolver instead.
stringtagsRequiredTags.
[string]: stringforceDeleteOptionalforceDelete deletes the secret immediately with no recovery window. Defaults to false, which uses a 7-day recovery window so an accidental delete can be undone. Set true only for throwaway/test secrets.
bool | *falsefalseObserved values
Outputs
Praxis records these values after observation. A dependent resource can read one with ${resources.<name>.outputs.<field>}.
arnStringnameStringversionIdStringRead without ownership
Data-source lookup
A data block reads an existing SecretsManagerSecret and exposes its outputs without storing lifecycle state. The generic filter surface accepts id, name, and tag; supported combinations depend on the AWS identity used by this resource.
data: existing: {
kind: "SecretsManagerSecret"
region: "us-west-2"
filter: {
name: "replace-with-provider-name"
}
}Adopt existing infrastructure
Import
Import persists Praxis state for an existing AWS resource. For this kind, supply: Provider identifier for the existing SecretsManagerSecret. The example starts in observed mode so Praxis reports drift without correcting it.
praxis import SecretsManagerSecret \
--id <provider-identifier> \
--region us-west-2 \
--account production \
--observeCanonical contract
Complete CUE schema
The field guide above is derived from this definition. The schema remains the source of truth for accepted values, defaults, validation constraints, and outputs in the current alpha revision.
Show the complete schema
package secretsmanager
#SecretsManagerSecret: {
apiVersion: "praxis.io/alpha"
kind: "SecretsManagerSecret"
metadata: {
// The secret name. May contain ASCII letters, numbers, and /_+=.@-
name: string & =~"^[a-zA-Z0-9/_+=.@\\-]{1,512}$"
labels: [string]: string
}
spec: {
region: string
description?: string
// kmsKeyId is the KMS key used to encrypt the secret value; when omitted,
// the account default key (alias/aws/secretsmanager) is used.
kmsKeyId?: string
// secretString is the sensitive secret value. It is never emitted as an
// output; reference it with a sensitivity-aware resolver instead.
secretString: string
tags: [string]: string
// forceDelete deletes the secret immediately with no recovery window.
// Defaults to false, which uses a 7-day recovery window so an accidental
// delete can be undone. Set true only for throwaway/test secrets.
forceDelete: bool | *false
}
// Outputs intentionally exclude secretString so the secret value never flows
// into deployment state or expression hydration.
outputs?: {
arn: string
name: string
versionId: string
}
}