secretsmanager

type GetRandomPasswordArgs struct {
	// String of the characters that you don't want in the password.
	ExcludeCharacters *string `pulumi:"excludeCharacters"`
	// Specifies whether to exclude lowercase letters from the password.
	ExcludeLowercase *bool `pulumi:"excludeLowercase"`
	// Specifies whether to exclude numbers from the password.
	ExcludeNumbers *bool `pulumi:"excludeNumbers"`
	// Specifies whether to exclude the following punctuation characters from the password: “! " # $ % & ' ( ) * + , - . / : ; < = > ? @ [ \ ] ^ _ ` { | } ~ .“
	ExcludePunctuation *bool `pulumi:"excludePunctuation"`
	// Specifies whether to exclude uppercase letters from the password.
	ExcludeUppercase *bool `pulumi:"excludeUppercase"`
	// Specifies whether to include the space character.
	IncludeSpace *bool `pulumi:"includeSpace"`
	// Length of the password.
	PasswordLength *int `pulumi:"passwordLength"`
	// Region where this resource will be [managed](https://docs.aws.amazon.com/general/latest/gr/rande.html#regional-endpoints). Defaults to the Region set in the provider configuration.
	Region *string `pulumi:"region"`
	// Specifies whether to include at least one upper and lowercase letter, one number, and one punctuation.
	RequireEachIncludedType *bool `pulumi:"requireEachIncludedType"`
}

type GetRandomPasswordOutputArgs struct {
	// String of the characters that you don't want in the password.
	ExcludeCharacters pulumi.StringPtrInput `pulumi:"excludeCharacters"`
	// Specifies whether to exclude lowercase letters from the password.
	ExcludeLowercase pulumi.BoolPtrInput `pulumi:"excludeLowercase"`
	// Specifies whether to exclude numbers from the password.
	ExcludeNumbers pulumi.BoolPtrInput `pulumi:"excludeNumbers"`
	// Specifies whether to exclude the following punctuation characters from the password: “! " # $ % & ' ( ) * + , - . / : ; < = > ? @ [ \ ] ^ _ ` { | } ~ .“
	ExcludePunctuation pulumi.BoolPtrInput `pulumi:"excludePunctuation"`
	// Specifies whether to exclude uppercase letters from the password.
	ExcludeUppercase pulumi.BoolPtrInput `pulumi:"excludeUppercase"`
	// Specifies whether to include the space character.
	IncludeSpace pulumi.BoolPtrInput `pulumi:"includeSpace"`
	// Length of the password.
	PasswordLength pulumi.IntPtrInput `pulumi:"passwordLength"`
	// Region where this resource will be [managed](https://docs.aws.amazon.com/general/latest/gr/rande.html#regional-endpoints). Defaults to the Region set in the provider configuration.
	Region pulumi.StringPtrInput `pulumi:"region"`
	// Specifies whether to include at least one upper and lowercase letter, one number, and one punctuation.
	RequireEachIncludedType pulumi.BoolPtrInput `pulumi:"requireEachIncludedType"`
}

type GetRandomPasswordResult struct {
	ExcludeCharacters  *string `pulumi:"excludeCharacters"`
	ExcludeLowercase   *bool   `pulumi:"excludeLowercase"`
	ExcludeNumbers     *bool   `pulumi:"excludeNumbers"`
	ExcludePunctuation *bool   `pulumi:"excludePunctuation"`
	ExcludeUppercase   *bool   `pulumi:"excludeUppercase"`
	// The provider-assigned unique ID for this managed resource.
	Id             string `pulumi:"id"`
	IncludeSpace   *bool  `pulumi:"includeSpace"`
	PasswordLength *int   `pulumi:"passwordLength"`
	// Random password.
	RandomPassword          string `pulumi:"randomPassword"`
	Region                  string `pulumi:"region"`
	RequireEachIncludedType *bool  `pulumi:"requireEachIncludedType"`
}

type GetRandomPasswordResultOutput struct{ *pulumi.OutputState }

type GetSecretRotationRotationRule struct {
	// Number of days between automatic scheduled rotations of the secret.
	AutomaticallyAfterDays int `pulumi:"automaticallyAfterDays"`
	// Length of the rotation window in hours.
	Duration string `pulumi:"duration"`
	// A `cron()` or `rate()` expression that defines the schedule for rotating the secret.
	ScheduleExpression string `pulumi:"scheduleExpression"`
}

type GetSecretRotationRotationRuleArgs struct {
	// Number of days between automatic scheduled rotations of the secret.
	AutomaticallyAfterDays pulumi.IntInput `pulumi:"automaticallyAfterDays"`
	// Length of the rotation window in hours.
	Duration pulumi.StringInput `pulumi:"duration"`
	// A `cron()` or `rate()` expression that defines the schedule for rotating the secret.
	ScheduleExpression pulumi.StringInput `pulumi:"scheduleExpression"`
}

type GetSecretRotationRotationRuleArray []GetSecretRotationRotationRuleInput

type GetSecretRotationRotationRuleArrayInput interface {
	pulumi.Input

	ToGetSecretRotationRotationRuleArrayOutput() GetSecretRotationRotationRuleArrayOutput
	ToGetSecretRotationRotationRuleArrayOutputWithContext(context.Context) GetSecretRotationRotationRuleArrayOutput
}

type GetSecretRotationRotationRuleArrayOutput struct{ *pulumi.OutputState }

type GetSecretRotationRotationRuleInput interface {
	pulumi.Input

	ToGetSecretRotationRotationRuleOutput() GetSecretRotationRotationRuleOutput
	ToGetSecretRotationRotationRuleOutputWithContext(context.Context) GetSecretRotationRotationRuleOutput
}

type GetSecretRotationRotationRuleOutput struct{ *pulumi.OutputState }

type GetSecretVersionsArgs struct {
	// If true, all deprecated secret versions are included in the response.
	// If false, no deprecated secret versions are included in the response. If no value is specified, the default value is `false`.
	IncludeDeprecated *bool `pulumi:"includeDeprecated"`
	// Region where this resource will be [managed](https://docs.aws.amazon.com/general/latest/gr/rande.html#regional-endpoints). Defaults to the Region set in the provider configuration.
	Region *string `pulumi:"region"`
	// Specifies the secret containing the version that you want to retrieve. You can specify either the ARN or the friendly name of the secret.
	SecretId string `pulumi:"secretId"`
}

type GetSecretVersionsOutputArgs struct {
	// If true, all deprecated secret versions are included in the response.
	// If false, no deprecated secret versions are included in the response. If no value is specified, the default value is `false`.
	IncludeDeprecated pulumi.BoolPtrInput `pulumi:"includeDeprecated"`
	// Region where this resource will be [managed](https://docs.aws.amazon.com/general/latest/gr/rande.html#regional-endpoints). Defaults to the Region set in the provider configuration.
	Region pulumi.StringPtrInput `pulumi:"region"`
	// Specifies the secret containing the version that you want to retrieve. You can specify either the ARN or the friendly name of the secret.
	SecretId pulumi.StringInput `pulumi:"secretId"`
}

type GetSecretVersionsResult struct {
	// ARN of the secret.
	Arn string `pulumi:"arn"`
	// The provider-assigned unique ID for this managed resource.
	Id                string `pulumi:"id"`
	IncludeDeprecated *bool  `pulumi:"includeDeprecated"`
	Name              string `pulumi:"name"`
	Region            string `pulumi:"region"`
	SecretId          string `pulumi:"secretId"`
	// List of the versions of the secret. Attributes are specified below.
	Versions []GetSecretVersionsVersion `pulumi:"versions"`
}

type GetSecretVersionsResultOutput struct{ *pulumi.OutputState }

type GetSecretVersionsVersion struct {
	// Date and time this version of the secret was created.
	CreatedTime string `pulumi:"createdTime"`
	// Date that this version of the secret was last accessed.
	LastAccessedDate string `pulumi:"lastAccessedDate"`
	// Unique version identifier of this version of the secret.
	VersionId string `pulumi:"versionId"`
	// List of staging labels attached to the version.
	VersionStages []string `pulumi:"versionStages"`
}

type GetSecretVersionsVersionArgs struct {
	// Date and time this version of the secret was created.
	CreatedTime pulumi.StringInput `pulumi:"createdTime"`
	// Date that this version of the secret was last accessed.
	LastAccessedDate pulumi.StringInput `pulumi:"lastAccessedDate"`
	// Unique version identifier of this version of the secret.
	VersionId pulumi.StringInput `pulumi:"versionId"`
	// List of staging labels attached to the version.
	VersionStages pulumi.StringArrayInput `pulumi:"versionStages"`
}

type GetSecretVersionsVersionArray []GetSecretVersionsVersionInput

type GetSecretVersionsVersionArrayInput interface {
	pulumi.Input

	ToGetSecretVersionsVersionArrayOutput() GetSecretVersionsVersionArrayOutput
	ToGetSecretVersionsVersionArrayOutputWithContext(context.Context) GetSecretVersionsVersionArrayOutput
}

type GetSecretVersionsVersionArrayOutput struct{ *pulumi.OutputState }

type GetSecretVersionsVersionInput interface {
	pulumi.Input

	ToGetSecretVersionsVersionOutput() GetSecretVersionsVersionOutput
	ToGetSecretVersionsVersionOutputWithContext(context.Context) GetSecretVersionsVersionOutput
}

type GetSecretVersionsVersionOutput struct{ *pulumi.OutputState }

type GetSecretsArgs struct {
	// Configuration block(s) for filtering. Detailed below.
	Filters []GetSecretsFilter `pulumi:"filters"`
	// Region where this resource will be [managed](https://docs.aws.amazon.com/general/latest/gr/rande.html#regional-endpoints). Defaults to the Region set in the provider configuration.
	Region *string `pulumi:"region"`
}

type GetSecretsFilter struct {
	// Name of the filter field. Valid values can be found in the [Secrets Manager ListSecrets API Reference](https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_ListSecrets.html).
	Name string `pulumi:"name"`
	// Set of values that are accepted for the given filter field. Results will be selected if any given value matches.
	Values []string `pulumi:"values"`
}

type GetSecretsFilterArgs struct {
	// Name of the filter field. Valid values can be found in the [Secrets Manager ListSecrets API Reference](https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_ListSecrets.html).
	Name pulumi.StringInput `pulumi:"name"`
	// Set of values that are accepted for the given filter field. Results will be selected if any given value matches.
	Values pulumi.StringArrayInput `pulumi:"values"`
}

type GetSecretsFilterArray []GetSecretsFilterInput

type GetSecretsFilterArrayInput interface {
	pulumi.Input

	ToGetSecretsFilterArrayOutput() GetSecretsFilterArrayOutput
	ToGetSecretsFilterArrayOutputWithContext(context.Context) GetSecretsFilterArrayOutput
}

type GetSecretsFilterArrayOutput struct{ *pulumi.OutputState }

type GetSecretsFilterInput interface {
	pulumi.Input

	ToGetSecretsFilterOutput() GetSecretsFilterOutput
	ToGetSecretsFilterOutputWithContext(context.Context) GetSecretsFilterOutput
}

type GetSecretsFilterOutput struct{ *pulumi.OutputState }

type GetSecretsOutputArgs struct {
	// Configuration block(s) for filtering. Detailed below.
	Filters GetSecretsFilterArrayInput `pulumi:"filters"`
	// Region where this resource will be [managed](https://docs.aws.amazon.com/general/latest/gr/rande.html#regional-endpoints). Defaults to the Region set in the provider configuration.
	Region pulumi.StringPtrInput `pulumi:"region"`
}

type GetSecretsResult struct {
	// Set of ARNs of the matched Secrets Manager secrets.
	Arns    []string           `pulumi:"arns"`
	Filters []GetSecretsFilter `pulumi:"filters"`
	// The provider-assigned unique ID for this managed resource.
	Id string `pulumi:"id"`
	// Set of names of the matched Secrets Manager secrets.
	Names  []string `pulumi:"names"`
	Region string   `pulumi:"region"`
}

type GetSecretsResultOutput struct{ *pulumi.OutputState }

type LookupSecretArgs struct {
	// ARN of the secret to retrieve.
	Arn *string `pulumi:"arn"`
	// Name of the secret to retrieve.
	Name *string `pulumi:"name"`
	// Region where this resource will be [managed](https://docs.aws.amazon.com/general/latest/gr/rande.html#regional-endpoints). Defaults to the Region set in the provider configuration.
	Region *string `pulumi:"region"`
	// Tags of the secret.
	Tags map[string]string `pulumi:"tags"`
}

type LookupSecretOutputArgs struct {
	// ARN of the secret to retrieve.
	Arn pulumi.StringPtrInput `pulumi:"arn"`
	// Name of the secret to retrieve.
	Name pulumi.StringPtrInput `pulumi:"name"`
	// Region where this resource will be [managed](https://docs.aws.amazon.com/general/latest/gr/rande.html#regional-endpoints). Defaults to the Region set in the provider configuration.
	Region pulumi.StringPtrInput `pulumi:"region"`
	// Tags of the secret.
	Tags pulumi.StringMapInput `pulumi:"tags"`
}

type LookupSecretResult struct {
	// ARN of the secret.
	Arn string `pulumi:"arn"`
	// Created date of the secret in UTC.
	CreatedDate string `pulumi:"createdDate"`
	// Description of the secret.
	Description string `pulumi:"description"`
	// The provider-assigned unique ID for this managed resource.
	Id string `pulumi:"id"`
	// Key Management Service (KMS) Customer Master Key (CMK) associated with the secret.
	KmsKeyId string `pulumi:"kmsKeyId"`
	// Last updated date of the secret in UTC.
	LastChangedDate string `pulumi:"lastChangedDate"`
	Name            string `pulumi:"name"`
	// Resource-based policy document that's attached to the secret.
	Policy string `pulumi:"policy"`
	Region string `pulumi:"region"`
	// Tags of the secret.
	Tags map[string]string `pulumi:"tags"`
}

type LookupSecretResultOutput struct{ *pulumi.OutputState }

type LookupSecretRotationArgs struct {
	// Region where this resource will be [managed](https://docs.aws.amazon.com/general/latest/gr/rande.html#regional-endpoints). Defaults to the Region set in the provider configuration.
	Region *string `pulumi:"region"`
	// Specifies the secret containing the version that you want to retrieve. You can specify either the ARN or the friendly name of the secret.
	SecretId string `pulumi:"secretId"`
}

type LookupSecretRotationOutputArgs struct {
	// Region where this resource will be [managed](https://docs.aws.amazon.com/general/latest/gr/rande.html#regional-endpoints). Defaults to the Region set in the provider configuration.
	Region pulumi.StringPtrInput `pulumi:"region"`
	// Specifies the secret containing the version that you want to retrieve. You can specify either the ARN or the friendly name of the secret.
	SecretId pulumi.StringInput `pulumi:"secretId"`
}

type LookupSecretRotationResult struct {
	// The provider-assigned unique ID for this managed resource.
	Id     string `pulumi:"id"`
	Region string `pulumi:"region"`
	// Specifies whether automatic rotation is enabled for this secret.
	RotationEnabled bool `pulumi:"rotationEnabled"`
	// Amazon Resource Name (ARN) of the lambda function used for rotation.
	RotationLambdaArn string `pulumi:"rotationLambdaArn"`
	// Configuration block for rotation rules. See `rotationRules` below.
	RotationRules []GetSecretRotationRotationRule `pulumi:"rotationRules"`
	SecretId      string                          `pulumi:"secretId"`
}

type LookupSecretRotationResultOutput struct{ *pulumi.OutputState }

type LookupSecretVersionArgs struct {
	// Region where this resource will be [managed](https://docs.aws.amazon.com/general/latest/gr/rande.html#regional-endpoints). Defaults to the Region set in the provider configuration.
	Region *string `pulumi:"region"`
	// Specifies the secret containing the version that you want to retrieve. You can specify either the ARN or the friendly name of the secret.
	SecretId string `pulumi:"secretId"`
	// Specifies the unique identifier of the version of the secret that you want to retrieve. Overrides `versionStage`.
	VersionId *string `pulumi:"versionId"`
	// Specifies the secret version that you want to retrieve by the staging label attached to the version. Defaults to `AWSCURRENT`.
	VersionStage *string `pulumi:"versionStage"`
}

type LookupSecretVersionOutputArgs struct {
	// Region where this resource will be [managed](https://docs.aws.amazon.com/general/latest/gr/rande.html#regional-endpoints). Defaults to the Region set in the provider configuration.
	Region pulumi.StringPtrInput `pulumi:"region"`
	// Specifies the secret containing the version that you want to retrieve. You can specify either the ARN or the friendly name of the secret.
	SecretId pulumi.StringInput `pulumi:"secretId"`
	// Specifies the unique identifier of the version of the secret that you want to retrieve. Overrides `versionStage`.
	VersionId pulumi.StringPtrInput `pulumi:"versionId"`
	// Specifies the secret version that you want to retrieve by the staging label attached to the version. Defaults to `AWSCURRENT`.
	VersionStage pulumi.StringPtrInput `pulumi:"versionStage"`
}

type LookupSecretVersionResult struct {
	// ARN of the secret.
	Arn string `pulumi:"arn"`
	// Created date of the secret in UTC.
	CreatedDate string `pulumi:"createdDate"`
	// The provider-assigned unique ID for this managed resource.
	Id     string `pulumi:"id"`
	Region string `pulumi:"region"`
	// Decrypted part of the protected secret information that was originally provided as a binary.
	SecretBinary string `pulumi:"secretBinary"`
	SecretId     string `pulumi:"secretId"`
	// Decrypted part of the protected secret information that was originally provided as a string.
	SecretString string `pulumi:"secretString"`
	// Unique identifier of this version of the secret.
	VersionId     string   `pulumi:"versionId"`
	VersionStage  *string  `pulumi:"versionStage"`
	VersionStages []string `pulumi:"versionStages"`
}

type LookupSecretVersionResultOutput struct{ *pulumi.OutputState }

type Secret struct {
	pulumi.CustomResourceState

	// ARN of the secret.
	Arn pulumi.StringOutput `pulumi:"arn"`
	// Description of the secret.
	Description pulumi.StringPtrOutput `pulumi:"description"`
	// Accepts boolean value to specify whether to overwrite a secret with the same name in the destination Region.
	ForceOverwriteReplicaSecret pulumi.BoolPtrOutput `pulumi:"forceOverwriteReplicaSecret"`
	// ARN or Id of the AWS KMS key to be used to encrypt the secret values in the versions stored in this secret. If you need to reference a CMK in a different account, you can use only the key ARN. If you don't specify this value, then Secrets Manager defaults to using the AWS account's default KMS key (the one named `aws/secretsmanager`). If the default KMS key with that name doesn't yet exist, then AWS Secrets Manager creates it for you automatically the first time.
	KmsKeyId pulumi.StringPtrOutput `pulumi:"kmsKeyId"`
	// Friendly name of the new secret. The secret name can consist of uppercase letters, lowercase letters, digits, and any of the following characters: `/_+=.@-` Conflicts with `namePrefix`.
	Name pulumi.StringOutput `pulumi:"name"`
	// Creates a unique name beginning with the specified prefix. Conflicts with `name`.
	NamePrefix pulumi.StringOutput `pulumi:"namePrefix"`
	// Valid JSON document representing a [resource policy](https://docs.aws.amazon.com/secretsmanager/latest/userguide/auth-and-access_resource-based-policies.html). Removing `policy` from your configuration or setting `policy` to null or an empty string (i.e., `policy = ""`) _will not_ delete the policy since it could have been set by `secretsmanager.SecretPolicy`. To delete the `policy`, set it to `"{}"` (an empty JSON document).
	Policy pulumi.StringOutput `pulumi:"policy"`
	// Number of days that AWS Secrets Manager waits before it can delete the secret. This value can be `0` to force deletion without recovery or range from `7` to `30` days. The default value is `30`.
	RecoveryWindowInDays pulumi.IntPtrOutput `pulumi:"recoveryWindowInDays"`
	// Region where this resource will be [managed](https://docs.aws.amazon.com/general/latest/gr/rande.html#regional-endpoints). Defaults to the Region set in the provider configuration.
	Region pulumi.StringOutput `pulumi:"region"`
	// Configuration block to support secret replication. See details below.
	Replicas SecretReplicaArrayOutput `pulumi:"replicas"`
	// Key-value map of user-defined tags that are attached to the secret. If configured with a provider `defaultTags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
	Tags pulumi.StringMapOutput `pulumi:"tags"`
	// Map of tags assigned to the resource, including those inherited from the provider `defaultTags` configuration block.
	TagsAll pulumi.StringMapOutput `pulumi:"tagsAll"`
}

type SecretArgs struct {
	// Description of the secret.
	Description pulumi.StringPtrInput
	// Accepts boolean value to specify whether to overwrite a secret with the same name in the destination Region.
	ForceOverwriteReplicaSecret pulumi.BoolPtrInput
	// ARN or Id of the AWS KMS key to be used to encrypt the secret values in the versions stored in this secret. If you need to reference a CMK in a different account, you can use only the key ARN. If you don't specify this value, then Secrets Manager defaults to using the AWS account's default KMS key (the one named `aws/secretsmanager`). If the default KMS key with that name doesn't yet exist, then AWS Secrets Manager creates it for you automatically the first time.
	KmsKeyId pulumi.StringPtrInput
	// Friendly name of the new secret. The secret name can consist of uppercase letters, lowercase letters, digits, and any of the following characters: `/_+=.@-` Conflicts with `namePrefix`.
	Name pulumi.StringPtrInput
	// Creates a unique name beginning with the specified prefix. Conflicts with `name`.
	NamePrefix pulumi.StringPtrInput
	// Valid JSON document representing a [resource policy](https://docs.aws.amazon.com/secretsmanager/latest/userguide/auth-and-access_resource-based-policies.html). Removing `policy` from your configuration or setting `policy` to null or an empty string (i.e., `policy = ""`) _will not_ delete the policy since it could have been set by `secretsmanager.SecretPolicy`. To delete the `policy`, set it to `"{}"` (an empty JSON document).
	Policy pulumi.StringPtrInput
	// Number of days that AWS Secrets Manager waits before it can delete the secret. This value can be `0` to force deletion without recovery or range from `7` to `30` days. The default value is `30`.
	RecoveryWindowInDays pulumi.IntPtrInput
	// Region where this resource will be [managed](https://docs.aws.amazon.com/general/latest/gr/rande.html#regional-endpoints). Defaults to the Region set in the provider configuration.
	Region pulumi.StringPtrInput
	// Configuration block to support secret replication. See details below.
	Replicas SecretReplicaArrayInput
	// Key-value map of user-defined tags that are attached to the secret. If configured with a provider `defaultTags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
	Tags pulumi.StringMapInput
}

type SecretArray []SecretInput

type SecretArrayInput interface {
	pulumi.Input

	ToSecretArrayOutput() SecretArrayOutput
	ToSecretArrayOutputWithContext(context.Context) SecretArrayOutput
}

type SecretArrayOutput struct{ *pulumi.OutputState }

type SecretInput interface {
	pulumi.Input

	ToSecretOutput() SecretOutput
	ToSecretOutputWithContext(ctx context.Context) SecretOutput
}

type SecretMap map[string]SecretInput

type SecretMapInput interface {
	pulumi.Input

	ToSecretMapOutput() SecretMapOutput
	ToSecretMapOutputWithContext(context.Context) SecretMapOutput
}

type SecretMapOutput struct{ *pulumi.OutputState }

type SecretOutput struct{ *pulumi.OutputState }

type SecretPolicy struct {
	pulumi.CustomResourceState

	// Makes an optional API call to Zelkova to validate the Resource Policy to prevent broad access to your secret.
	BlockPublicPolicy pulumi.BoolPtrOutput `pulumi:"blockPublicPolicy"`
	// Valid JSON document representing a [resource policy](https://docs.aws.amazon.com/secretsmanager/latest/userguide/auth-and-access_resource-based-policies.html). Unlike `secretsmanager.Secret`, where `policy` can be set to `"{}"` to delete the policy, `"{}"` is not a valid policy since `policy` is required.
	Policy pulumi.StringOutput `pulumi:"policy"`
	// Region where this resource will be [managed](https://docs.aws.amazon.com/general/latest/gr/rande.html#regional-endpoints). Defaults to the Region set in the provider configuration.
	Region pulumi.StringOutput `pulumi:"region"`
	// Secret ARN.
	//
	// The following arguments are optional:
	SecretArn pulumi.StringOutput `pulumi:"secretArn"`
}

type SecretPolicyArgs struct {
	// Makes an optional API call to Zelkova to validate the Resource Policy to prevent broad access to your secret.
	BlockPublicPolicy pulumi.BoolPtrInput
	// Valid JSON document representing a [resource policy](https://docs.aws.amazon.com/secretsmanager/latest/userguide/auth-and-access_resource-based-policies.html). Unlike `secretsmanager.Secret`, where `policy` can be set to `"{}"` to delete the policy, `"{}"` is not a valid policy since `policy` is required.
	Policy pulumi.StringInput
	// Region where this resource will be [managed](https://docs.aws.amazon.com/general/latest/gr/rande.html#regional-endpoints). Defaults to the Region set in the provider configuration.
	Region pulumi.StringPtrInput
	// Secret ARN.
	//
	// The following arguments are optional:
	SecretArn pulumi.StringInput
}

type SecretPolicyArray []SecretPolicyInput

type SecretPolicyArrayInput interface {
	pulumi.Input

	ToSecretPolicyArrayOutput() SecretPolicyArrayOutput
	ToSecretPolicyArrayOutputWithContext(context.Context) SecretPolicyArrayOutput
}

type SecretPolicyArrayOutput struct{ *pulumi.OutputState }

type SecretPolicyInput interface {
	pulumi.Input

	ToSecretPolicyOutput() SecretPolicyOutput
	ToSecretPolicyOutputWithContext(ctx context.Context) SecretPolicyOutput
}

type SecretPolicyMap map[string]SecretPolicyInput

type SecretPolicyMapInput interface {
	pulumi.Input

	ToSecretPolicyMapOutput() SecretPolicyMapOutput
	ToSecretPolicyMapOutputWithContext(context.Context) SecretPolicyMapOutput
}

type SecretPolicyMapOutput struct{ *pulumi.OutputState }

type SecretPolicyOutput struct{ *pulumi.OutputState }

type SecretPolicyState struct {
	// Makes an optional API call to Zelkova to validate the Resource Policy to prevent broad access to your secret.
	BlockPublicPolicy pulumi.BoolPtrInput
	// Valid JSON document representing a [resource policy](https://docs.aws.amazon.com/secretsmanager/latest/userguide/auth-and-access_resource-based-policies.html). Unlike `secretsmanager.Secret`, where `policy` can be set to `"{}"` to delete the policy, `"{}"` is not a valid policy since `policy` is required.
	Policy pulumi.StringPtrInput
	// Region where this resource will be [managed](https://docs.aws.amazon.com/general/latest/gr/rande.html#regional-endpoints). Defaults to the Region set in the provider configuration.
	Region pulumi.StringPtrInput
	// Secret ARN.
	//
	// The following arguments are optional:
	SecretArn pulumi.StringPtrInput
}

type SecretReplica struct {
	// ARN, Key ID, or Alias of the AWS KMS key within the region secret is replicated to. If one is not specified, then Secrets Manager defaults to using the AWS account's default KMS key (`aws/secretsmanager`) in the region or creates one for use if non-existent.
	KmsKeyId *string `pulumi:"kmsKeyId"`
	// Date that you last accessed the secret in the Region.
	LastAccessedDate *string `pulumi:"lastAccessedDate"`
	// Region for replicating the secret.
	Region string `pulumi:"region"`
	// Status can be `InProgress`, `Failed`, or `InSync`.
	Status *string `pulumi:"status"`
	// Message such as `Replication succeeded` or `Secret with this name already exists in this region`.
	StatusMessage *string `pulumi:"statusMessage"`
}

type SecretReplicaArgs struct {
	// ARN, Key ID, or Alias of the AWS KMS key within the region secret is replicated to. If one is not specified, then Secrets Manager defaults to using the AWS account's default KMS key (`aws/secretsmanager`) in the region or creates one for use if non-existent.
	KmsKeyId pulumi.StringPtrInput `pulumi:"kmsKeyId"`
	// Date that you last accessed the secret in the Region.
	LastAccessedDate pulumi.StringPtrInput `pulumi:"lastAccessedDate"`
	// Region for replicating the secret.
	Region pulumi.StringInput `pulumi:"region"`
	// Status can be `InProgress`, `Failed`, or `InSync`.
	Status pulumi.StringPtrInput `pulumi:"status"`
	// Message such as `Replication succeeded` or `Secret with this name already exists in this region`.
	StatusMessage pulumi.StringPtrInput `pulumi:"statusMessage"`
}

type SecretReplicaArray []SecretReplicaInput

type SecretReplicaArrayInput interface {
	pulumi.Input

	ToSecretReplicaArrayOutput() SecretReplicaArrayOutput
	ToSecretReplicaArrayOutputWithContext(context.Context) SecretReplicaArrayOutput
}

type SecretReplicaArrayOutput struct{ *pulumi.OutputState }

type SecretReplicaInput interface {
	pulumi.Input

	ToSecretReplicaOutput() SecretReplicaOutput
	ToSecretReplicaOutputWithContext(context.Context) SecretReplicaOutput
}

type SecretReplicaOutput struct{ *pulumi.OutputState }

type SecretRotation struct {
	pulumi.CustomResourceState

	// Region where this resource will be [managed](https://docs.aws.amazon.com/general/latest/gr/rande.html#regional-endpoints). Defaults to the Region set in the provider configuration.
	Region pulumi.StringOutput `pulumi:"region"`
	// Specifies whether to rotate the secret immediately or wait until the next scheduled rotation window. The rotation schedule is defined in `rotationRules`. For secrets that use a Lambda rotation function to rotate, if you don't immediately rotate the secret, Secrets Manager tests the rotation configuration by running the testSecret step (https://docs.aws.amazon.com/secretsmanager/latest/userguide/rotate-secrets_how.html) of the Lambda rotation function. The test creates an AWSPENDING version of the secret and then removes it. Defaults to `true`.
	RotateImmediately pulumi.BoolPtrOutput `pulumi:"rotateImmediately"`
	// Specifies whether automatic rotation is enabled for this secret.
	RotationEnabled pulumi.BoolOutput `pulumi:"rotationEnabled"`
	// Specifies the ARN of the Lambda function that can rotate the secret. Must be supplied if the secret is not managed by AWS.
	RotationLambdaArn pulumi.StringPtrOutput `pulumi:"rotationLambdaArn"`
	// A structure that defines the rotation configuration for this secret. Defined below.
	RotationRules SecretRotationRotationRulesOutput `pulumi:"rotationRules"`
	// Specifies the secret to which you want to add a new version. You can specify either the Amazon Resource Name (ARN) or the friendly name of the secret. The secret must already exist.
	SecretId pulumi.StringOutput `pulumi:"secretId"`
}

type SecretRotationArgs struct {
	// Region where this resource will be [managed](https://docs.aws.amazon.com/general/latest/gr/rande.html#regional-endpoints). Defaults to the Region set in the provider configuration.
	Region pulumi.StringPtrInput
	// Specifies whether to rotate the secret immediately or wait until the next scheduled rotation window. The rotation schedule is defined in `rotationRules`. For secrets that use a Lambda rotation function to rotate, if you don't immediately rotate the secret, Secrets Manager tests the rotation configuration by running the testSecret step (https://docs.aws.amazon.com/secretsmanager/latest/userguide/rotate-secrets_how.html) of the Lambda rotation function. The test creates an AWSPENDING version of the secret and then removes it. Defaults to `true`.
	RotateImmediately pulumi.BoolPtrInput
	// Specifies the ARN of the Lambda function that can rotate the secret. Must be supplied if the secret is not managed by AWS.
	RotationLambdaArn pulumi.StringPtrInput
	// A structure that defines the rotation configuration for this secret. Defined below.
	RotationRules SecretRotationRotationRulesInput
	// Specifies the secret to which you want to add a new version. You can specify either the Amazon Resource Name (ARN) or the friendly name of the secret. The secret must already exist.
	SecretId pulumi.StringInput
}

type SecretRotationArray []SecretRotationInput

type SecretRotationArrayInput interface {
	pulumi.Input

	ToSecretRotationArrayOutput() SecretRotationArrayOutput
	ToSecretRotationArrayOutputWithContext(context.Context) SecretRotationArrayOutput
}

type SecretRotationArrayOutput struct{ *pulumi.OutputState }

type SecretRotationInput interface {
	pulumi.Input

	ToSecretRotationOutput() SecretRotationOutput
	ToSecretRotationOutputWithContext(ctx context.Context) SecretRotationOutput
}

type SecretRotationMap map[string]SecretRotationInput

type SecretRotationMapInput interface {
	pulumi.Input

	ToSecretRotationMapOutput() SecretRotationMapOutput
	ToSecretRotationMapOutputWithContext(context.Context) SecretRotationMapOutput
}

type SecretRotationMapOutput struct{ *pulumi.OutputState }

type SecretRotationOutput struct{ *pulumi.OutputState }

type SecretRotationRotationRules struct {
	// Specifies the number of days between automatic scheduled rotations of the secret. Either `automaticallyAfterDays` or `scheduleExpression` must be specified.
	AutomaticallyAfterDays *int `pulumi:"automaticallyAfterDays"`
	// The length of the rotation window in hours. For example, `3h` for a three hour window.
	Duration *string `pulumi:"duration"`
	// A `cron()` or `rate()` expression that defines the schedule for rotating your secret. Either `automaticallyAfterDays` or `scheduleExpression` must be specified.
	ScheduleExpression *string `pulumi:"scheduleExpression"`
}

type SecretRotationRotationRulesArgs struct {
	// Specifies the number of days between automatic scheduled rotations of the secret. Either `automaticallyAfterDays` or `scheduleExpression` must be specified.
	AutomaticallyAfterDays pulumi.IntPtrInput `pulumi:"automaticallyAfterDays"`
	// The length of the rotation window in hours. For example, `3h` for a three hour window.
	Duration pulumi.StringPtrInput `pulumi:"duration"`
	// A `cron()` or `rate()` expression that defines the schedule for rotating your secret. Either `automaticallyAfterDays` or `scheduleExpression` must be specified.
	ScheduleExpression pulumi.StringPtrInput `pulumi:"scheduleExpression"`
}

type SecretRotationRotationRulesInput interface {
	pulumi.Input

	ToSecretRotationRotationRulesOutput() SecretRotationRotationRulesOutput
	ToSecretRotationRotationRulesOutputWithContext(context.Context) SecretRotationRotationRulesOutput
}

type SecretRotationRotationRulesOutput struct{ *pulumi.OutputState }

type SecretRotationRotationRulesPtrInput interface {
	pulumi.Input

	ToSecretRotationRotationRulesPtrOutput() SecretRotationRotationRulesPtrOutput
	ToSecretRotationRotationRulesPtrOutputWithContext(context.Context) SecretRotationRotationRulesPtrOutput
}

type SecretRotationRotationRulesPtrOutput struct{ *pulumi.OutputState }

type SecretRotationState struct {
	// Region where this resource will be [managed](https://docs.aws.amazon.com/general/latest/gr/rande.html#regional-endpoints). Defaults to the Region set in the provider configuration.
	Region pulumi.StringPtrInput
	// Specifies whether to rotate the secret immediately or wait until the next scheduled rotation window. The rotation schedule is defined in `rotationRules`. For secrets that use a Lambda rotation function to rotate, if you don't immediately rotate the secret, Secrets Manager tests the rotation configuration by running the testSecret step (https://docs.aws.amazon.com/secretsmanager/latest/userguide/rotate-secrets_how.html) of the Lambda rotation function. The test creates an AWSPENDING version of the secret and then removes it. Defaults to `true`.
	RotateImmediately pulumi.BoolPtrInput
	// Specifies whether automatic rotation is enabled for this secret.
	RotationEnabled pulumi.BoolPtrInput
	// Specifies the ARN of the Lambda function that can rotate the secret. Must be supplied if the secret is not managed by AWS.
	RotationLambdaArn pulumi.StringPtrInput
	// A structure that defines the rotation configuration for this secret. Defined below.
	RotationRules SecretRotationRotationRulesPtrInput
	// Specifies the secret to which you want to add a new version. You can specify either the Amazon Resource Name (ARN) or the friendly name of the secret. The secret must already exist.
	SecretId pulumi.StringPtrInput
}

type SecretState struct {
	// ARN of the secret.
	Arn pulumi.StringPtrInput
	// Description of the secret.
	Description pulumi.StringPtrInput
	// Accepts boolean value to specify whether to overwrite a secret with the same name in the destination Region.
	ForceOverwriteReplicaSecret pulumi.BoolPtrInput
	// ARN or Id of the AWS KMS key to be used to encrypt the secret values in the versions stored in this secret. If you need to reference a CMK in a different account, you can use only the key ARN. If you don't specify this value, then Secrets Manager defaults to using the AWS account's default KMS key (the one named `aws/secretsmanager`). If the default KMS key with that name doesn't yet exist, then AWS Secrets Manager creates it for you automatically the first time.
	KmsKeyId pulumi.StringPtrInput
	// Friendly name of the new secret. The secret name can consist of uppercase letters, lowercase letters, digits, and any of the following characters: `/_+=.@-` Conflicts with `namePrefix`.
	Name pulumi.StringPtrInput
	// Creates a unique name beginning with the specified prefix. Conflicts with `name`.
	NamePrefix pulumi.StringPtrInput
	// Valid JSON document representing a [resource policy](https://docs.aws.amazon.com/secretsmanager/latest/userguide/auth-and-access_resource-based-policies.html). Removing `policy` from your configuration or setting `policy` to null or an empty string (i.e., `policy = ""`) _will not_ delete the policy since it could have been set by `secretsmanager.SecretPolicy`. To delete the `policy`, set it to `"{}"` (an empty JSON document).
	Policy pulumi.StringPtrInput
	// Number of days that AWS Secrets Manager waits before it can delete the secret. This value can be `0` to force deletion without recovery or range from `7` to `30` days. The default value is `30`.
	RecoveryWindowInDays pulumi.IntPtrInput
	// Region where this resource will be [managed](https://docs.aws.amazon.com/general/latest/gr/rande.html#regional-endpoints). Defaults to the Region set in the provider configuration.
	Region pulumi.StringPtrInput
	// Configuration block to support secret replication. See details below.
	Replicas SecretReplicaArrayInput
	// Key-value map of user-defined tags that are attached to the secret. If configured with a provider `defaultTags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
	Tags pulumi.StringMapInput
	// Map of tags assigned to the resource, including those inherited from the provider `defaultTags` configuration block.
	TagsAll pulumi.StringMapInput
}

type SecretVersion struct {
	pulumi.CustomResourceState

	// The ARN of the secret.
	Arn pulumi.StringOutput `pulumi:"arn"`
	// Region where this resource will be [managed](https://docs.aws.amazon.com/general/latest/gr/rande.html#regional-endpoints). Defaults to the Region set in the provider configuration.
	Region pulumi.StringOutput `pulumi:"region"`
	// Specifies binary data that you want to encrypt and store in this version of the secret. This is required if `secretString` or `secretStringWo` is not set. Needs to be encoded to base64.
	SecretBinary pulumi.StringPtrOutput `pulumi:"secretBinary"`
	// Specifies the secret to which you want to add a new version. You can specify either the Amazon Resource Name (ARN) or the friendly name of the secret. The secret must already exist.
	SecretId pulumi.StringOutput `pulumi:"secretId"`
	// Specifies text data that you want to encrypt and store in this version of the secret. This is required if `secretBinary` or `secretStringWo` is not set.
	SecretString pulumi.StringPtrOutput `pulumi:"secretString"`
	// The unique identifier of the version of the secret.
	VersionId pulumi.StringOutput `pulumi:"versionId"`
	// Specifies a list of staging labels that are attached to this version of the secret. A staging label must be unique to a single version of the secret. If you specify a staging label that's already associated with a different version of the same secret then that staging label is automatically removed from the other version and attached to this version. If you do not specify a value, then AWS Secrets Manager automatically moves the staging label `AWSCURRENT` to this new version on creation.
	//
	// > **NOTE:** If `versionStages` is configured, you must include the `AWSCURRENT` staging label if this secret version is the only version or if the label is currently present on this secret version, otherwise this provider will show a perpetual difference.
	VersionStages pulumi.StringArrayOutput `pulumi:"versionStages"`
}

type SecretVersionArgs struct {
	// Region where this resource will be [managed](https://docs.aws.amazon.com/general/latest/gr/rande.html#regional-endpoints). Defaults to the Region set in the provider configuration.
	Region pulumi.StringPtrInput
	// Specifies binary data that you want to encrypt and store in this version of the secret. This is required if `secretString` or `secretStringWo` is not set. Needs to be encoded to base64.
	SecretBinary pulumi.StringPtrInput
	// Specifies the secret to which you want to add a new version. You can specify either the Amazon Resource Name (ARN) or the friendly name of the secret. The secret must already exist.
	SecretId pulumi.StringInput
	// Specifies text data that you want to encrypt and store in this version of the secret. This is required if `secretBinary` or `secretStringWo` is not set.
	SecretString pulumi.StringPtrInput
	// Specifies a list of staging labels that are attached to this version of the secret. A staging label must be unique to a single version of the secret. If you specify a staging label that's already associated with a different version of the same secret then that staging label is automatically removed from the other version and attached to this version. If you do not specify a value, then AWS Secrets Manager automatically moves the staging label `AWSCURRENT` to this new version on creation.
	//
	// > **NOTE:** If `versionStages` is configured, you must include the `AWSCURRENT` staging label if this secret version is the only version or if the label is currently present on this secret version, otherwise this provider will show a perpetual difference.
	VersionStages pulumi.StringArrayInput
}

type SecretVersionArray []SecretVersionInput

type SecretVersionArrayInput interface {
	pulumi.Input

	ToSecretVersionArrayOutput() SecretVersionArrayOutput
	ToSecretVersionArrayOutputWithContext(context.Context) SecretVersionArrayOutput
}

type SecretVersionArrayOutput struct{ *pulumi.OutputState }

type SecretVersionInput interface {
	pulumi.Input

	ToSecretVersionOutput() SecretVersionOutput
	ToSecretVersionOutputWithContext(ctx context.Context) SecretVersionOutput
}

type SecretVersionMap map[string]SecretVersionInput

type SecretVersionMapInput interface {
	pulumi.Input

	ToSecretVersionMapOutput() SecretVersionMapOutput
	ToSecretVersionMapOutputWithContext(context.Context) SecretVersionMapOutput
}

type SecretVersionMapOutput struct{ *pulumi.OutputState }

type SecretVersionOutput struct{ *pulumi.OutputState }

type SecretVersionState struct {
	// The ARN of the secret.
	Arn pulumi.StringPtrInput
	// Region where this resource will be [managed](https://docs.aws.amazon.com/general/latest/gr/rande.html#regional-endpoints). Defaults to the Region set in the provider configuration.
	Region pulumi.StringPtrInput
	// Specifies binary data that you want to encrypt and store in this version of the secret. This is required if `secretString` or `secretStringWo` is not set. Needs to be encoded to base64.
	SecretBinary pulumi.StringPtrInput
	// Specifies the secret to which you want to add a new version. You can specify either the Amazon Resource Name (ARN) or the friendly name of the secret. The secret must already exist.
	SecretId pulumi.StringPtrInput
	// Specifies text data that you want to encrypt and store in this version of the secret. This is required if `secretBinary` or `secretStringWo` is not set.
	SecretString pulumi.StringPtrInput
	// The unique identifier of the version of the secret.
	VersionId pulumi.StringPtrInput
	// Specifies a list of staging labels that are attached to this version of the secret. A staging label must be unique to a single version of the secret. If you specify a staging label that's already associated with a different version of the same secret then that staging label is automatically removed from the other version and attached to this version. If you do not specify a value, then AWS Secrets Manager automatically moves the staging label `AWSCURRENT` to this new version on creation.
	//
	// > **NOTE:** If `versionStages` is configured, you must include the `AWSCURRENT` staging label if this secret version is the only version or if the label is currently present on this secret version, otherwise this provider will show a perpetual difference.
	VersionStages pulumi.StringArrayInput
}