AWS secretsmanager documentation change
Summary
Expanded documentation about secret tagging including new sections on tag basics, cost tracking, tag restrictions, and detailed procedures for console/CLI/SDK operations
Security assessment
The changes enhance documentation about using tags for ABAC (attribute-based access control) which is a security feature, but there's no indication of addressing a specific vulnerability. The warning about not storing sensitive data in tags remains present but wasn't modified.
Diff
diff --git a/secretsmanager/latest/userguide/managing-secrets_tagging.md b/secretsmanager/latest/userguide/managing-secrets_tagging.md index 2ea30f358..d353e8725 100644 --- a//secretsmanager/latest/userguide/managing-secrets_tagging.md +++ b//secretsmanager/latest/userguide/managing-secrets_tagging.md @@ -5 +5 @@ -AWS CLIAWS SDK +Review tag basicsTrack costs using taggingUnderstand tag restrictionsTagging secrets in the console AWS CLIAPISDK @@ -7 +7 @@ AWS CLIAWS SDK -# Tag AWS Secrets Manager secrets +# Tagging secrets in AWS Secrets Manager @@ -9 +9 @@ AWS CLIAWS SDK -Secrets Manager defines a _tag_ as a label consisting of a key that you define and an optional value. You can use tags to make it easy to manage, search, and filter secrets and other resources in your AWS account. When you tag your secrets, use a standard naming scheme across all of your resources. For more information, see the [Tagging Best Practices](https://docs.aws.amazon.com/whitepapers/latest/tagging-best-practices/tagging-best-practices.html) whitepaper. +In AWS Secrets Manager, you can assign metadata to your secrets using tags. A tag is a key-value pair that you define for a secret. Tags help you manage AWS resources and organize data, including billing information. @@ -11 +11 @@ Secrets Manager defines a _tag_ as a label consisting of a key that you define a -You can grant or deny access to a secret by checking the tags attached to the secret. For more information, see [Control access to secrets using attribute-based access control (ABAC) ](./auth-and-access-abac.html). +With tags, you can: @@ -13 +13 @@ You can grant or deny access to a secret by checking the tags attached to the se -You can find secrets by tags in the console, AWS CLI, and SDKs. AWS also provides the [Resource Groups](https://docs.aws.amazon.com/ARG/latest/userguide/resource-groups.html) tool to create a custom console that consolidates and organizes your resources based on their tags. To find secrets with a specific tag, see [Find secrets in AWS Secrets Manager](./manage_search-secret.html). Secrets Manager doesn't support tag-based cost allocation. + * Manage, search, and filter secrets and other resources in your AWS account @@ -15 +15 @@ You can find secrets by tags in the console, AWS CLI, and SDKs. AWS also provide -Never store sensitive information for a secret in a tag. + * Control access to secrets based on attached tags @@ -17 +17,10 @@ Never store sensitive information for a secret in a tag. -For tag quotas and naming restrictions, see [Service quotas for Tagging](https://docs.aws.amazon.com/general/latest/gr/arg.html#taged-reference-quotas) in the _AWS General Reference guide_. Tags are case sensitive. + * Track and categorize expenses associated with specific secrets or projects + + + + +For more information about using tags to control access, see [Control access to secrets using attribute-based access control (ABAC)](./auth-and-access-abac.html). + +To learn about cost allocation tags, see [Using AWS cost allocation tags](https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/cost-alloc-tags.html) in the AWS Billing User Guide. + +For information about tag quotas and naming restrictions, see [Service quotas for Tagging](https://docs.aws.amazon.com/general/latest/gr/arg.html#taged-reference-quotas) in the _AWS General Reference guide_. Tags are case-sensitive. @@ -21 +30,73 @@ Secrets Manager generates a CloudTrail log entry when you tag or untag a secret. -###### To change tags for your secret (console) +###### Tip + +Use a consistent tagging scheme across all your AWS resources. For best practices, see the [Tagging Best Practices](https://docs.aws.amazon.com/whitepapers/latest/tagging-best-practices/tagging-best-practices.html) whitepaper. + +## Review tag basics + +You can find secrets by tags in the console, AWS CLI, and SDKs. AWS also provides the [Resource Groups](https://docs.aws.amazon.com/ARG/latest/userguide/resource-groups.html) tool to create a custom console that consolidates and organizes your resources based on their tags. To find secrets with a specific tag, see [Find secrets in AWS Secrets Manager](./manage_search-secret.html). + +You can use the Secrets Manager console, AWS CLI, or Secrets Manager API to: + + * Create a secret with tags + + * Add tags to a secret + + * List the tags for your secrets + + * Remove tags from a secret + + + + +You can use tags to categorize your secrets. For example, you can categorize secrets by purpose, owner, or environment. Because you define the key and value for each tag, you can create a custom set of categories to meet your specific needs. Here are several examples of tags: + + * `Project: Project name` + + * `Owner: Name` + + * `Purpose: Load testing` + + * `Application: Application name` + + * `Environment: Production` + + + + +## Track costs using tagging + +You can use tags to categorize and track your AWS costs. When you apply tags to your AWS resources, including secrets, your AWS cost allocation report includes usage and costs aggregated by tags. You can apply tags that represent business categories (such as cost centers, application names, or owners) to organize your costs across multiple services. For more information, see [Use Cost Allocation Tags for Custom Billing Reports](https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/cost-alloc-tags.html) in the _AWS Billing User Guide_. + +## Understand tag restrictions + +The following restrictions apply to tags. + +###### Basic restrictions + + * The maximum number of tags per resource (secret) is 50. + + * Tag keys and values are case-sensitive. + + * You can't change or edit tags for a deleted secret. + + + + +###### Tag key restrictions + + * Each tag key must be unique. If you add a tag with a key that's already in use, your new tag overwrites the existing key-value pair. + + * You can't start a tag key with `aws:` because this prefix is reserved for use by AWS. AWS creates tags that begin with this prefix on your behalf, but you can't edit or delete them. + + * Tag keys must be between 1 and 128 Unicode characters in length. + + * Tag keys must consist of the following characters: Unicode letters, digits, white space, and the following special characters: `_ . / = + - @`. + + + + +###### Tag value restrictions + + * Tag values must be between 0 and 255 Unicode characters in length. + + * Tag values can be blank. Otherwise, they must consist of the following characters: Unicode letters, digits, white space, and any of the following special characters: `_ . / = + - @`. @@ -23 +103,0 @@ Secrets Manager generates a CloudTrail log entry when you tag or untag a secret. - 1. Open the Secrets Manager console at [https://console.aws.amazon.com/secretsmanager/](https://console.aws.amazon.com/secretsmanager/). @@ -25 +104,0 @@ Secrets Manager generates a CloudTrail log entry when you tag or untag a secret. - 2. From the list of secrets, choose your secret. @@ -27 +105,0 @@ Secrets Manager generates a CloudTrail log entry when you tag or untag a secret. - 3. In the secret details page, on the **Tags** tab, choose **Edit tags**. Tag key names and values are case sensitive, and tag keys must be unique. @@ -28,0 +107 @@ Secrets Manager generates a CloudTrail log entry when you tag or untag a secret. +## Tag secrets using the Secrets Manager console @@ -29,0 +109 @@ Secrets Manager generates a CloudTrail log entry when you tag or untag a secret. +You can manage tags for your secrets using the [Secrets Manager console](https://console.aws.amazon.com/secretsmanager). @@ -30,0 +111 @@ Secrets Manager generates a CloudTrail log entry when you tag or untag a secret. +To access the tagging features, do the following: @@ -32 +113,50 @@ Secrets Manager generates a CloudTrail log entry when you tag or untag a secret. -## AWS CLI + 1. Open the Secrets Manager console. + + 2. In the navigation bar, choose your preferred Region. + + 3. On the **Secrets** page, select a secret. + + + + +###### To view the tags for a secret + + * On the **Secret Details** page, choose the **Tags** tab. + + + + +###### To create a secret with a tag + + * Follow the steps in [Create secrets](./create_secret.html). + + + + +###### To add or edit tags for a secret + + 1. On the **Secret Details** page, choose the **Tags** tab and then choose **Edit tags**. + + 2. Enter the tag key in the **Key** field. Optionally, enter a tag value in the **Value** field. + + 3. Choose **Save**. The new or updated tag appears in the list of tags. + +###### Note + +If the **Save** button is not enabled, the tag key or value might not meet the tag restrictions. For more information, see Understand tag restrictions. + + + + +###### To remove a tag from a secret + + 1. On the **Secret details** page, choose the **Tags** tab, and then choose the **Remove** icon next to the tag you want to remove. + + 2. Choose **Save** to confirm the removal, or select **Undo** to cancel. + + + + +## Tag secrets using the AWS CLI + +### AWS CLI examples @@ -61 +191,25 @@ The following [`untag-resource`](https://docs.aws.amazon.com/cli/latest/referenc -## AWS SDK +## Tag secrets using the Secrets Manager API + +You can add, list, and remove tags using the Secrets Manager API. For examples, see the following documentation: + + * [ListSecrets](https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_ListSecrets.html): Use `ListSecrets` to view the tags applied to a secret + + * [TagResource](https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_TagResource.html): Add tags to a secret + + * [Untag](https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_UntagResource.html): Remove tags from a secret + + + + +## Tag secrets using the Secrets Manager AWS SDK + +To change tags for your secret, use the following API operations: + + * [ListSecrets](https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_ListSecrets.html): Use `ListSecrets` to view the tags applied to a secret + + * [`TagResource`](https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_TagResource.html): Add tags to a secret + + * [`UntagResource`](https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_UntagResource.html): Remove tags from a secret + + +