The Wayback Machine - https://web.archive.org/web/20211027213921/https://docs.aws.amazon.com/secretsmanager/latest/userguide/retrieving-secrets.html
Retrieve secrets - AWS Secrets Manager
Retrieve secrets programmatically

Retrieve secrets

With Secrets Manager, you can programmatically and securely retrieve your secrets in your applications. You can also retrieve your secrets by using the console or the AWS CLI.

To retrieve a secret in the console, you must have these permissions:

  • secretsmanager:ListSecrets – Use to navigate to the secret to retrieve.

  • secretsmanager:DescribeSecret — Use to retrieve the non-encrypted parts of the secret.

  • secretsmanager:GetSecretValue – Use to retrieve the encrypted part of the secret.

  • kms:Decrypt – Required only if you used a customer managed key instead of the AWS managed key (aws/secretsmanager) to encrypt your secret.

To retrieve a secret (console)

  1. Open the Secrets Manager console at https://console.aws.amazon.com/secretsmanager/.

  2. On the Secrets page, choose your secret.

  3. On the Secret details page, in the Secret value section, choose Retrieve secret value.

  4. Do one of the following:

    • Choose Secret key/value to see the credentials as individual keys and values.

    • Choose Plaintext to see the JSON text string that Secrets Manager encrypts and stores.

Retrieve secrets programmatically

You can use the following commands to retrieve a secret stored in AWS Secrets Manager:

You identify the secret by the name or ARN. You can include the version, but if you don't specify a version, Secrets Manager defaults to the version with the staging label AWSCURRENT. Secrets Manager returns the contents of the secret text in the response parameters PlaintextString. If you stored binary data in the secret, Secrets Manager also returns Plaintext, a byte array. Secrets Manager uses the last modified date for the CreatedDate output.