Skip to content
AWS for Query.Farm

aws.secretsmanager.list_secrets

Example SQL Queries

SELECT * FROM
aws.secretsmanager.list_secrets;

Description

Lists the secrets that are stored by Secrets Manager in the Amazon Web Services account, not including secrets that are marked for deletion. To see secrets marked for deletion, use the Secrets Manager console.

All Secrets Manager operations are eventually consistent. ListSecrets might not reflect changes from the last five minutes. You can get more recent information for a specific secret by calling DescribeSecret.

To list the versions of a secret, use ListSecretVersionIds.

To retrieve the values for the secrets, call BatchGetSecretValue or GetSecretValue.

For information about finding secrets in the console, see Find secrets in Secrets Manager.

Secrets Manager generates a CloudTrail log entry when you call this action. Do not include sensitive information in request parameters because it might be logged. For more information, see Logging Secrets Manager events with CloudTrail.

Required permissions: secretsmanager:ListSecrets. For more information, see IAM policy actions for Secrets Manager and Authentication and access control in Secrets Manager.

Table Definition

Column NameColumn Data Type
filters Input Column

The filters to apply to the list of secrets.

STRUCT(
    "key" VARCHAR,
    "values" VARCHAR[]
)[]
Show child fields
filters[]
Show child fields
filters[].key

The following are keys you can use:

  • description: Prefix match, not case-sensitive.

  • name: Prefix match, case-sensitive.

  • tag-key: Prefix match, case-sensitive.

  • tag-value: Prefix match, case-sensitive.

  • primary-region: Prefix match, case-sensitive.

  • owning-service: Prefix match, case-sensitive.

  • all: Breaks the filter value string into words and then searches all attributes for matches. Not case-sensitive.

filters[].values[]
include_planned_deletion Input Column

Specifies whether to include secrets scheduled for deletion. By default, secrets scheduled for deletion aren't included.

BOOLEAN
sort_order Input Column

Secrets are listed by CreatedDate. 

VARCHAR
_aws_profile Input Column

The AWS profile defines the AWS identity used. It can be defined via credentials or by assuming a IAM role.

STRUCT(
    "type" VARCHAR,
    "name" VARCHAR,
    "account_id" VARCHAR,
    "via_profile_name" VARCHAR,
    "assumed_role_arn" VARCHAR,
    "organization" STRUCT(
        "account_name" VARCHAR,
        "id" VARCHAR,
        "tags" STRUCT(
            "key" VARCHAR,
            "value" VARCHAR
        )[],
        "master_account" STRUCT(
            "id" VARCHAR,
            "email" VARCHAR
        ),
        "parents" STRUCT(
            "type" VARCHAR,
            "id" VARCHAR,
            "name" VARCHAR,
            "tags" STRUCT(
                "key" VARCHAR,
                "value" VARCHAR
            )[]
        )[]
    )
)
Show child fields
_aws_profile.account_id

The AWS account id

_aws_profile.assumed_role_arn

The ARN of the assumed role

_aws_profile.name

The unique name of the profile.

_aws_profile.organization

Information about this profile's membership in the AWS organization.

Show child fields
_aws_profile.organization.account_name

The name of account speciifed by the organization

_aws_profile.organization.id

The organization id

_aws_profile.organization.master_account
Show child fields
_aws_profile.organization.master_account.email

The organization master account email address

_aws_profile.organization.master_account.id

The organization master account id

_aws_profile.organization.parents[]
Show child fields
_aws_profile.organization.parents[].id

The id of the parent

_aws_profile.organization.parents[].name

The name of the parent

_aws_profile.organization.parents[].tags[]
Show child fields
_aws_profile.organization.parents[].tags[].key
_aws_profile.organization.parents[].tags[].value
_aws_profile.organization.parents[].type

The type of parent can be an organization unit or a root

_aws_profile.organization.tags[]
Show child fields
_aws_profile.organization.tags[].key
_aws_profile.organization.tags[].value
_aws_profile.type

The type of profile, either 'credentials' or 'assumed_role'

_aws_profile.via_profile_name

This IAM role for this profile is assumed by first utilizing another profile with this name to obtain credentials.

_aws_region Input Column

The AWS region to use.

VARCHAR
arn

The Amazon Resource Name (ARN) of the secret.

VARCHAR
created_date

The date and time when a secret was created.

TIMESTAMP_S
deleted_date

The date and time the deletion of the secret occurred. Not present on active secrets. The secret can be recovered until the number of days in the recovery window has passed, as specified in the RecoveryWindowInDays parameter of the DeleteSecret operation.

TIMESTAMP_S
description

The user-provided description of the secret.

VARCHAR
kms_key_id

The ARN of the KMS key that Secrets Manager uses to encrypt the secret value. If the secret is encrypted with the Amazon Web Services managed key aws/secretsmanager, this field is omitted.

VARCHAR
last_accessed_date

The date that the secret was last accessed in the Region. This field is omitted if the secret has never been retrieved in the Region.

TIMESTAMP_S
last_changed_date

The last date and time that this secret was modified in any way.

TIMESTAMP_S
last_rotated_date

The most recent date and time that the Secrets Manager rotation process was successfully completed. This value is null if the secret hasn't ever rotated.

TIMESTAMP_S
name

The friendly name of the secret. 

VARCHAR
next_rotation_date

The next rotation is scheduled to occur on or before this date. If the secret isn't configured for rotation or rotation has been disabled, Secrets Manager returns null.

TIMESTAMP_S
owning_service

Returns the name of the service that created the secret.

VARCHAR
primary_region

The Region where Secrets Manager originated the secret.

VARCHAR
rotation_enabled

Indicates whether automatic, scheduled rotation is enabled for this secret.

BOOLEAN
rotation_lambda_arn

The ARN of an Amazon Web Services Lambda function invoked by Secrets Manager to rotate and expire the secret either automatically per the schedule or manually by a call to RotateSecret .

VARCHAR
rotation_rules

A structure that defines the rotation configuration for the secret.

STRUCT(
    "automatically_after_days" BIGINT,
    "duration" VARCHAR,
    "schedule_expression" VARCHAR
)
Show child fields
rotation_rules.automatically_after_days

The number of days between rotations of the secret. You can use this value to check that your secret meets your compliance guidelines for how often secrets must be rotated. If you use this field to set the rotation schedule, Secrets Manager calculates the next rotation date based on the previous rotation. Manually updating the secret value by calling PutSecretValue or UpdateSecret is considered a valid rotation.

In DescribeSecret and ListSecrets, this value is calculated from the rotation schedule after every successful rotation. In RotateSecret, you can set the rotation schedule in RotationRules with AutomaticallyAfterDays or ScheduleExpression, but not both. To set a rotation schedule in hours, use ScheduleExpression.

rotation_rules.duration

The length of the rotation window in hours, for example 3h for a three hour window. Secrets Manager rotates your secret at any time during this window. The window must not extend into the next rotation window or the next UTC day. The window starts according to the ScheduleExpression. If you don't specify a Duration, for a ScheduleExpression in hours, the window automatically closes after one hour. For a ScheduleExpression in days, the window automatically closes at the end of the UTC day. For more information, including examples, see Schedule expressions in Secrets Manager rotation in the Secrets Manager Users Guide.

rotation_rules.schedule_expression

A cron() or rate() expression that defines the schedule for rotating your secret. Secrets Manager rotation schedules use UTC time zone. Secrets Manager rotates your secret any time during a rotation window.

Secrets Manager rate() expressions represent the interval in hours or days that you want to rotate your secret, for example rate(12 hours) or rate(10 days). You can rotate a secret as often as every four hours. If you use a rate() expression, the rotation window starts at midnight. For a rate in hours, the default rotation window closes after one hour. For a rate in days, the default rotation window closes at the end of the day. You can set the Duration to change the rotation window. The rotation window must not extend into the next UTC day or into the next rotation window.

You can use a cron() expression to create a rotation schedule that is more detailed than a rotation interval. For more information, including examples, see Schedule expressions in Secrets Manager rotation in the Secrets Manager Users Guide. For a cron expression that represents a schedule in hours, the default rotation window closes after one hour. For a cron expression that represents a schedule in days, the default rotation window closes at the end of the day. You can set the Duration to change the rotation window. The rotation window must not extend into the next UTC day or into the next rotation window.

secret_versions_to_stages

A list of all of the currently assigned SecretVersionStage staging labels and the SecretVersionId attached to each one. Staging labels are used to keep track of the different versions during the rotation process.

A version that does not have any SecretVersionStage is considered deprecated and subject to deletion. Such versions are not included in this list.

MAP(VARCHAR, VARCHAR[])
tags

The list of user-defined tags associated with the secret. To add tags to a secret, use TagResource . To remove tags, use UntagResource .

STRUCT(
    "key" VARCHAR,
    "value" VARCHAR
)[]
Show child fields
tags[]
Show child fields
tags[].key

The key identifier, or name, of the tag.

tags[].value

The string value associated with the key of the tag.