AWS Secrets Manager

This source includes a cache for values. This avoids repeatedly querying for the same value e.g. if it’s used by multiple providers. The cache lives for as long as the current configuration generation, so a reload always pulls fresh values.

This source can detect rotated secrets. Configure watch as described in the Secret overview and tilegroxy will notice when a secret’s current version changes and reload itself. Change detection reads version metadata only and never decrypts the secret, so it adds no KMS usage.

Secrets Manager places secrets inside a JSON structure if configured through the console. To support that keys should be in the structure of id:key with id being the ID of the secret as a whole and key being the key from the JSON Object stored in the secret. If the secret isn’t JSON then you only need to supply the id by itself. You can override the separator used to be any value rather than a colon (:). Binary secrets aren’t supported, make sure there’s a string value.

This supports the standard means of authenticating with AWS. Ensure your user/role includes permission both to retrieve the secrets as well as permission to use the relevant KMS key to decrypt it. If you enable watch, also grant secretsmanager:DescribeSecret.