PingOne Privilege

AWS Secrets Manager integration

Connect AWS Secrets Manager to PingOne Privilege as a secrets hub so that users can use secrets stored in AWS Secrets Manager.

Configure AWS Secrets Manager integration

Before you begin

Ensure you have the following:

  • The required permissions in AWS to deploy the provided CloudFormation template.

  • Your AWS administrator can provide the Role ARN generated in the CloudFormation stack outputs.

Add AWS Secrets Manager as a secrets hub

  1. In the PingOne Privilege admin console, go to Secrets > Hubs.

  2. On the Secrets Hubs page, click the Add Hubs tab.

  3. In the AWS tile, click Integrate .

  4. Enter a Name and optional Description for the Hub. Click Next.

  5. To access the AWS console, either copy and paste the CloudFormation Template URL in a new browser tab or click the Open CF Template In AWS Console button.

  6. In the AWS console, create the CloudFormation stack using the provided template.

  7. When prompted, enter the External ID copied from PingOne Privilege.

  8. Verify that you copied the Role ARN from the completed stack outputs, then paste it into the configuration window.

    PingOne Privilege validates the ARN format before allowing you to continue.

  9. Click Next.

  10. On the Filters step, optionally select AWS Regions or secret tag key-value pairs. Leave both empty to synchronize all secrets. Click Next.

  11. Review the summary, including any filters, and submit the configuration.

    PingOne Privilege validates duplicate Hub names before submission.

  12. Validate the connection:

    1. In the Active Hubs tab, locate the new hub.

    2. Open the hub and verify that its connection status is Synced.

      A new or resynchronizing hub might temporarily display a pending status or a Syncing…​ indicator. If the status is Error, review the hub configuration and AWS permissions.

Use cases

You can use the AWS Secrets Manager hub for the following use cases.

Rotating secrets

When a session that used an injected secret checks in, PingOne Privilege triggers the configured rotation operation for that secret in AWS Secrets Manager.

This means:

  • The secret used by the checked-in session is rotated in AWS Secrets Manager without manual intervention.

  • The next session that requests the secret receives the current value.

Automatic rotation must be configured for the secret in AWS Secrets Manager, and the role used by PingOne Privilege must have the permissions required for the configured rotation operation.

Auditing secret usage

Each use of a secret is recorded as an audit event in the PingOne Privilege audit trail. The event includes the secret name as metadata.

  1. In the PingOne Privilege admin console, go to Activity > Activity Logs.

  2. Use the available filters to locate the session or user activity.

  3. Review the audit event and confirm that it includes the name of the secret that was used.