diff --git a/website/pages/docs/from-1.5/functions/contextual/aws_secretsmanager.mdx b/website/pages/docs/from-1.5/functions/contextual/aws_secretsmanager.mdx index 483e08176..50bbbe376 100644 --- a/website/pages/docs/from-1.5/functions/contextual/aws_secretsmanager.mdx +++ b/website/pages/docs/from-1.5/functions/contextual/aws_secretsmanager.mdx @@ -12,20 +12,22 @@ Secrets can be read from the [AWS Secrets Manager](https://aws.amazon.com/secrets-manager/) and used within your template as locals. +~> Note: Support for AWS secrets will always obtain the latest version of a secret, essentially +AWSCURRENT. Support for previous versions of a secret is not supported. + ```hcl aws_secretsmanager(name, key) ``` When key is not set (`null` or empty: `""`) then `aws_secretsmanager` returns -the first secret key stored in secret `name` using the `AWSCURRENT`. +the first secret key stored in secret `name`. You can either use this function in a `locals` block or directly inline where you want to use the value. ```hcl locals { - // null is equivalent to "AWSCURRENT" - current_version = aws_secretsmanager("my_secret", null) + secret = aws_secretsmanager("my_secret", null) } source "null" "first-example" { @@ -38,13 +40,50 @@ build { provisioner "shell-local" { environment_vars = ["TESTVAR=${build.PackerRunUUID}"] - inline = ["echo current version is '${local.current_version}'", - "echo previous version is '${aws_secretsmanager("my_secret", "AWSPREVIOUS")}'."] + inline = ["echo my_secret is '${local.secret}'", + "echo my_secret using an inline call is '${aws_secretsmanager("my_secret", null)}'."] } } ``` -This will load the key stored at behind `my_secret` from aws secrets manager. +This will load the key stored behind `my_secret` from aws secrets manager. + +The retrieval of single key secrets or plaintext secrets can be obtained by specifying (`null` or empty: `""`) as the `key`. + + +When obtaining secrets that have multiple keys you can set `key` to the specific key you would like +to fetch. For example, given the following secret with two keys if `key` is set to "shell" `aws_secretsmanager` will +return only its value. + +```json +{ + "test": "kitchen", + "shell": "powershell" +} +``` + +```hcl +locals { + secret = aws_secretsmanager("multikey/secret", "shell") +} + +source "null" "first-example" { + communicator = "none" +} + +build { + name = "my-build-name" + sources = ["null.first-example"] + + provisioner "shell-local" { + environment_vars = ["TESTVAR=${build.PackerRunUUID}"] + inline = ["echo my_secret is '${local.secret}'"] + } +} +``` + +This will load the value `"powershell"` stored in the key `"shell"` behind `multikey/secret`. + In order to use this function you have to configure valid AWS credentials using