aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap

[AWS::SecretsManager::Secret] - [Enhancement] - Support --import-existing-resources

Open
#2,375 0 comments 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
No language data
Stars
1.1k
Forks
62
PR merge metrics
No merged PRs in 30d

Description

### Name of the resource

AWS::SecretsManager::Secret

### Resource name

_No response_

### Description

An SecretsManager::Secret is an obvious resource to set as:
```json
"UpdateReplacePolicy" : "Retain",
"DeletionPolicy" : "RetainExceptOnCreate"
```

e.g. if it's a pepper used to hash values stored persistently - that secret cannot change.

However, because its `primariyIdentifier` is `Id` and `Id` is a read only property it cannot be imported using `--import-existing-resources`. So if you created the secret via CloudFormation (or the CDK) and want to recreate the stack using the same secret it does not work trivially.

### Other Details

_No response_

Contributor guide

Open the contributing guide

Research direction

Start with the AWS::SecretsManager::Secret entry and the --import-existing-resources behavior described here, paying attention to its read-only primaryIdentifier Id and the stated UpdateReplacePolicy and DeletionPolicy use. Done means a retained secret created by CloudFormation or CDK can be reused when recreating the stack through --import-existing-resources.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws
Domain
cloud, infrastructure
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.