AWS Secrets Manager

How to store secrets in AWS

This is an older version of the ZenML documentation. To read and view the latest version please visit this up-to-date URL.

The AWS secrets manager is a secrets manager flavor provided with the ZenML aws integration that uses AWS to store secrets.

When to use it

You should use the AWS secrets manager if:

• a component of your stack requires a secret for authentication or you want to use secrets inside your steps.

• you're already using AWS, especially if your orchestrator is running in AWS. If you're using a different cloud provider, take a look at the other secrets manager flavors.

How to deploy it

The AWS secrets manager is automatically activated once you create an AWS account.

How to use it

To use the AWS secrets manager, we need:

• The ZenML aws integration installed. If you haven't done so, run

  zenml integration install aws

• The AWS CLI installed and authenticated.

• A region in which you want to store your secrets. Choose one from the list here.

We can then register the secrets manager and use it in our active stack:

zenml secrets-manager register <NAME> \
    --flavor=aws \
    --region_name=<REGION>

# Add the secrets manager to the active stack
zenml stack update -x <NAME>

You can now register, update or delete secrets using the CLI or fetch secret values inside your steps.

You can use secret scoping with the AWS Secrets Manager to emulate multiple Secrets Manager namespaces on top of a single AWS region.

A concrete example of using the AWS secrets manager can be found here.

For more information and a full list of configurable attributes of the AWS secrets manager, check out the API Docs.