Documentation
¶
Overview ¶
Package secretsmanager is doze-aws's local AWS Secrets Manager: secrets with version stages (AWSCURRENT/AWSPREVIOUS plus custom labels), deletion with a recovery window, tags, and resource-policy round-trips. Secret values are genuinely encrypted at rest with a per-data-dir AES-256-GCM key the service manages itself (a KMS KeyId is recorded and returned cosmetically).
Rotation (RotateSecret) drives the four-step protocol against a configured rotation Lambda via peers. Cross-region replication is physically meaningless locally and answers honestly.
See docs/api-support/secretsmanager.md for the support table.
Index ¶
- type Options
- type Secret
- type Server
- type Store
- func (s *Store) AddVersion(id, token string, str, bin []byte, stages []string) (*Secret, string, error)
- func (s *Store) Create(name, description, kmsKeyID, token string, str, bin []byte, ...) (*Secret, string, error)
- func (s *Store) Delete(id string, recoveryDays int, force bool) (*Secret, error)
- func (s *Store) Get(id string) (*Secret, error)
- func (s *Store) List() ([]Secret, error)
- func (s *Store) Mutate(id string, fn func(*Secret) error) (*Secret, error)
- func (s *Store) Restore(id string) (*Secret, error)
- func (s *Store) SweepDeleted()
- type Version
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Options ¶
type Options struct {
// DataDir holds the bbolt store (secretsmanager.bolt) and the value
// encryption key (secretsmanager.key). Required.
DataDir string
// Peers lets RotateSecret invoke the configured rotation lambda.
Peers peers.Directory
// Logf receives log lines; nil discards.
Logf func(format string, args ...any)
// Clock overrides time.Now in tests.
Clock func() time.Time
}
Options configures the service.
type Secret ¶
type Secret struct {
ARN string `json:"arn"`
Name string `json:"name"`
Description string `json:"description,omitempty"`
KMSKeyID string `json:"kms_key_id,omitempty"`
Tags map[string]string `json:"tags,omitempty"`
Policy string `json:"policy,omitempty"` // resource policy round-trip
Versions map[string]Version `json:"versions"`
Created int64 `json:"created"`
LastChanged int64 `json:"last_changed"`
RotationEnabled bool `json:"rotation_enabled,omitempty"`
RotationLambdaARN string `json:"rotation_lambda_arn,omitempty"`
LastRotatedDate int64 `json:"last_rotated_date,omitempty"`
DeletedAt int64 `json:"deleted_at,omitempty"` // scheduled-deletion time set
PurgeAt int64 `json:"purge_at,omitempty"` // when the janitor removes it
}
Secret is one secret with its version map.
type Server ¶
type Server struct {
// contains filtered or unexported fields
}
Server is the Secrets Manager service: an http.Handler speaking AWS JSON 1.1, and an io.Closer that stops the janitor and closes the store.
type Store ¶
type Store struct {
// contains filtered or unexported fields
}
Store is the bbolt-backed secret store plus the value sealer.
func (*Store) AddVersion ¶
func (s *Store) AddVersion(id, token string, str, bin []byte, stages []string) (*Secret, string, error)
AddVersion appends a version and moves AWSCURRENT (old current becomes AWSPREVIOUS), returning the new version id.
func (*Store) Create ¶
func (s *Store) Create(name, description, kmsKeyID, token string, str, bin []byte, tags map[string]string) (*Secret, string, error)
Create makes a new secret with an initial version, or fails if it exists.
func (*Store) SweepDeleted ¶
func (s *Store) SweepDeleted()
SweepDeleted purges secrets whose recovery window has passed.
type Version ¶
type Version struct {
String []byte `json:"string,omitempty"` // sealed
Binary []byte `json:"binary,omitempty"` // sealed
Stages []string `json:"stages,omitempty"`
Created int64 `json:"created"`
}
Version is one secret version. Exactly one of String/Binary was set by the caller; both are sealed at rest.
Source Files