getSecretVersion function

Retrieve information about a Secrets Manager secret version, including its secret value. To retrieve secret metadata, see the aws.secretsmanager.Secret data source.

Example Usage

Retrieve Current Secret Version

By default, this data sources retrieves information based on the AWSCURRENT staging label.

import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";

const secret_version = aws.secretsmanager.getSecretVersion({
    secretId: example.id,
});

import pulumi
import pulumi_aws as aws

secret_version = aws.secretsmanager.get_secret_version(secret_id=example["id"])

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Aws = Pulumi.Aws;

return await Deployment.RunAsync(() =>
{
    var secret_version = Aws.SecretsManager.GetSecretVersion.Invoke(new()
    {
        SecretId = example.Id,
    });

});

package main

import (
	"github.com/pulumi/pulumi-aws/sdk/v7/go/aws/secretsmanager"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := secretsmanager.LookupSecretVersion(ctx, &secretsmanager.LookupSecretVersionArgs{
			SecretId: example.Id,
		}, nil)
		if err != nil {
			return err
		}
		return nil
	})
}

pulumi {
  required_providers {
    aws = {
      source = "pulumi/aws"
    }
  }
}

data "aws_secretsmanager_getsecretversion" "secret-version" {
  secret_id = example.id
}

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.aws.secretsmanager.SecretsmanagerFunctions;
import com.pulumi.aws.secretsmanager.inputs.GetSecretVersionArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        final var secret-version = SecretsmanagerFunctions.getSecretVersion(GetSecretVersionArgs.builder()
            .secretId(example.id())
            .build());

    }
}

variables:
  secret-version:
    fn::invoke:
      function: aws:secretsmanager:getSecretVersion
      arguments:
        secretId: ${example.id}

Retrieve Specific Secret Version

import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";

const by_version_stage = aws.secretsmanager.getSecretVersion({
    secretId: example.id,
    versionStage: "example",
});

import pulumi
import pulumi_aws as aws

by_version_stage = aws.secretsmanager.get_secret_version(secret_id=example["id"],
    version_stage="example")

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Aws = Pulumi.Aws;

return await Deployment.RunAsync(() =>
{
    var by_version_stage = Aws.SecretsManager.GetSecretVersion.Invoke(new()
    {
        SecretId = example.Id,
        VersionStage = "example",
    });

});

package main

import (
	"github.com/pulumi/pulumi-aws/sdk/v7/go/aws/secretsmanager"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := secretsmanager.LookupSecretVersion(ctx, &secretsmanager.LookupSecretVersionArgs{
			SecretId:     example.Id,
			VersionStage: pulumi.StringRef("example"),
		}, nil)
		if err != nil {
			return err
		}
		return nil
	})
}

pulumi {
  required_providers {
    aws = {
      source = "pulumi/aws"
    }
  }
}

data "aws_secretsmanager_getsecretversion" "by-version-stage" {
  secret_id     = example.id
  version_stage = "example"
}

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.aws.secretsmanager.SecretsmanagerFunctions;
import com.pulumi.aws.secretsmanager.inputs.GetSecretVersionArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        final var by-version-stage = SecretsmanagerFunctions.getSecretVersion(GetSecretVersionArgs.builder()
            .secretId(example.id())
            .versionStage("example")
            .build());

    }
}

variables:
  by-version-stage:
    fn::invoke:
      function: aws:secretsmanager:getSecretVersion
      arguments:
        secretId: ${example.id}
        versionStage: example

Handling Key-Value Secret Strings in JSON

Reading key-value pairs from JSON back into a native map

import * as pulumi from "@pulumi/pulumi";
import * as std from "@pulumi/std";

export const example = std.jsondecode({
    input: exampleAwsSecretsmanagerSecretVersion.secretString,
}).then(invoke => invoke.result?.key1);

import pulumi
import pulumi_std as std

pulumi.export("example", std.jsondecode(input=example_aws_secretsmanager_secret_version["secretString"]).result["key1"])

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Std = Pulumi.Std;

return await Deployment.RunAsync(() =>
{
    return new Dictionary<string, object?>
    {
        ["example"] = Std.Jsondecode.Invoke(new()
        {
            Input = exampleAwsSecretsmanagerSecretVersion.SecretString,
        }).Apply(invoke => invoke.Result?.Key1),
    };
});

package main

import (
	"github.com/pulumi/pulumi-std/sdk/go/std"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		ctx.Export("example", pulumi.Any(std.Jsondecode(ctx, &std.JsondecodeArgs{
			Input: exampleAwsSecretsmanagerSecretVersion.SecretString,
		}, nil).Result.Key1))
		return nil
	})
}

pulumi {
  required_providers {
    std = {
      source = "pulumi/std"
    }
  }
}

output "example" {
  value = jsondecode(exampleAwsSecretsmanagerSecretVersion.secretString)["key1"]
}

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.std.StdFunctions;
import com.pulumi.std.inputs.JsondecodeArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        ctx.export("example", StdFunctions.jsondecode(JsondecodeArgs.builder()
            .input(exampleAwsSecretsmanagerSecretVersion.secretString())
            .build()).result().key1());
    }
}

outputs:
  example:
    fn::invoke:
      function: std:jsondecode
      arguments:
        input: ${exampleAwsSecretsmanagerSecretVersion.secretString}
      return: result.key1

args Arguments passed to this invoke. Arguments for getSecretVersion. options Invoke options controlling this call.