Connectors

AWS Secrets Manager Connector

The AWS Secrets Manager connector lets you retrieve, create, update, and delete secrets stored in AWS Secrets Manager in your PingOne DaVinci flow.

You can use the connector to externalize secrets such as API keys and client credentials, so you don’t need to store them directly in your flow configuration. For example, use the connector to retrieve a secret and pass it into the Make REST API Call capability of the HTTP connector instead of hardcoding the credential in the flow.

Setup

Resources

You can find more information and setup help in the following:

Requirements

To use the connector, you’ll need:

  • An AWS account with access to AWS Secrets Manager.

  • An AWS IAM access key ID and secret access key with permissions to read and, optionally, create, update, and delete the secrets you plan to use. Follow AWS guidance to use least-privilege permissions, avoid root credentials, and store access keys securely.

  • The AWS Region your secrets are stored in.

  • Optionally, a second AWS access key ID, secret access key, and region if you want the connector to fail over to a secondary AWS account or region when the primary request fails.

Configuring the AWS Secrets Manager connector

Add the connector in PingOne DaVinci as shown in Adding a connector, then configure it as follows.

Connector configuration

Setting Description

AWS Access Key

The AWS IAM access key ID used to authenticate with AWS Secrets Manager.

AWS Access Secret

The AWS IAM secret access key paired with the AWS Access Key.

AWS Region

The AWS Region your secrets are stored in.

Secondary AWS Access Key

Optional. A fallback AWS IAM access key ID the connector uses if the primary request times out or can’t connect.

Secondary AWS Access Secret

Optional. The AWS IAM secret access key paired with the Secondary AWS Access Key.

Secondary AWS Region

Optional. A fallback AWS Region the connector uses if the primary request times out or can’t connect.

Using the connector in a flow

Retrieving a secret

Use the Get Secret capability to retrieve the current value of a secret by its name or ARN. If a secondary AWS configuration is set and the primary request fails, the connector retries the request using the secondary AWS Access Key, AWS Access Secret, and AWS Region. Treat secret values as sensitive data. Do not log them, expose them in user-facing responses, or return them from a flow unless required for the intended integration. The capability outputs whether the primary or secondary configuration was used.

Creating a secret

Use the Create Secret capability to create a new secret. You can optionally set a description, encrypt the secret with a specific KMS Key ID, overwrite an existing secret of the same name, and recover a soft-deleted secret before setting its new value.

Updating a secret

Use the Update Secret capability to update the value, description, or KMS key of an existing secret.

Deleting a secret

Use the Delete Secret capability to mark a secret for deletion. The secret remains recoverable during AWS’s configured recovery window, which defaults to 30 days.

Capabilities

Get Secret

Fetch the stored value of a secret

Show details

  • Properties

  • Input Schema

  • Output Schema

Secret Name / ARN textField required

The name or ARN of the secret

  • default object

    • properties object

      • secretName string required

        The name of the secret to get

Input Example

{
  "properties": {
    "secretName": "MySecret"
  }
}

  • output object

    • secret string

    • usedPrimaryConfiguration boolean

    • response object

      • $metadata object

        • httpStatusCode integer

        • requestId string

        • attempts integer

        • totalRetryDelay integer

      • ARN string

      • CreatedDate string

      • Name string

      • SecretString string

      • VersionId string

      • VersionStages array

        • Array Item Schema string

Create Secret

Create a new secret

Show details

  • Properties

  • Input Schema

  • Output Schema

Secret Name / ARN textField required

The name or ARN of the secret

Secret Value textField required

The secret value

Description textField

A description of the secret

KMS Key ID textField

The KMS Key ID, or ARN/alias ARN of the KMS key used to encrypt the secret

Overwrite if exists toggleSwitch

Whether to overwrite the secret if it already exists.

Recover Soft Delete toggleSwitch

Whether to recover the secret first if it has been deleted and is still recoverable.

  • default object

    • properties object

      • secretName string required

        The name of the secret to create

      • secretValue string required

        The value of the secret to create

      • secretDescription string

        The description of the secret

      • kmsKeyId string

        The KMS Key ID, or ARN/alias ARN of the KMS key used to encrypt the secret

      • overwriteIfExists boolean

        Whether to overwrite an existing secret with the same name.

      • recoverFromSoftDelete boolean

        Whether to recover the secret first if it has been soft-deleted and is still recoverable.

Input Example

{
  "properties": {
    "secretName": "MySecret",
    "secretValue": "ThisIsASecret",
    "secretDescription": "I need to store the MySecret secret, overwrite it if it already exists, and not recover it if it has been deleted.",
    "kmsKeyId": "MyKeyID",
    "overwriteIfExists": true,
    "recoverFromSoftDelete": false
  }
}

  • output object

    • usedPrimaryConfiguration boolean

    • response object

      • $metadata object

        • httpStatusCode integer

        • requestId string

        • attempts integer

        • totalRetryDelay integer

      • ARN string

      • Name string

      • VersionId string

Update Secret

Updates the description, value, or KMS key of an existing secret

Show details

  • Properties

  • Input Schema

  • Output Schema

Secret Name / ARN textField required

The name or ARN of the secret

Secret Value textField required

The secret value

Description textField

A description of the secret

KMS Key ID textField

The KMS Key ID, or ARN/alias ARN of the KMS key used to encrypt the secret

  • default object

    • properties object

      • secretName string required

        The name of the secret to update

      • secretValue string required

        The value of the secret to store

      • secretDescription string

        The description of the secret

      • kmsKeyId string

        The KMS Key ID, or ARN/alias ARN of the KMS key used to encrypt the secret

Input Example

{
  "properties": {
    "secretName": "MySecret",
    "secretValue": "ThisIsAnUpdatedSecret",
    "secretDescription": "I need to update the value and description of MySecret"
  }
}

  • output object

    • usedPrimaryConfiguration boolean

    • response object

      • $metadata object

        • httpStatusCode integer

        • requestId string

        • attempts integer

        • totalRetryDelay integer

      • ARN string

      • Name string

      • VersionId string

Delete Secret

Schedules a secret for deletion. The secret remains recoverable during AWS’s configured recovery window, which defaults to 30 days.

Show details

  • Properties

  • Input Schema

  • Output Schema

Secret Name / ARN textField required

The name or ARN of the secret

  • default object

    • properties object

      • secretName string required

        The name of the secret to delete

Input Example

{
  "properties": {
    "secretName": "MySecret"
  }
}

  • output object

    • usedPrimaryConfiguration boolean

    • response object

      • $metadata object

        • httpStatusCode integer

        • requestId string

        • attempts integer

        • totalRetryDelay integer

      • ARN string

      • DeletionDate string

      • Name string