View a markdown version of this page

Match AWS Secrets Manager events with Amazon EventBridge - AWS Secrets Manager
Match all changes to a specified secretMatch events when a secret value rotates

Match AWS Secrets Manager events with Amazon EventBridge

In Amazon EventBridge, you can match Secrets Manager events from CloudTrail log entries. You can configure EventBridge rules that look for these events and then send new generated events to a target to take action. For a list of CloudTrail entries that Secrets Manager logs, see CloudTrail entries. For instructions to set up EventBridge, see Getting started with EventBridge in the EventBridge User Guide.

Note

This topic describes matching Secrets Manager events that EventBridge derives from CloudTrail log entries. Secrets Manager also publishes native events directly to EventBridge, such as the Secret Label Updated event, which don't require CloudTrail. For more information about native events, see Secret event notifications.

Match all changes to a specified secret

Note

Because some Secrets Manager events return the ARN of the secret with different capitalization, in event patterns that match more than one action, to specify a secret by ARN, you may need to include both the keys arn and aRN. For more information, see AWS re:Post.

The following example shows an EventBridge event pattern that matches log entries for changes to a secret.

{
    "source": ["aws.secretsmanager"],
    "detail-type": ["AWS API Call via CloudTrail"],
    "detail": {
        "eventSource": ["secretsmanager.amazonaws.com"],
        "eventName": ["DeleteResourcePolicy", "PutResourcePolicy", "RotateSecret", "TagResource", "UntagResource", "UpdateSecret"],
        "responseElements": {
            "arn": ["arn:aws:secretsmanager:us-west-2:012345678901:secret:mySecret-a1b2c3"]
        }
    }
}

Match events when a secret value rotates

To detect when the active value of a secret changes, we recommend that you match the native Secret Label Updated event for the AWSCURRENT staging label. Secrets Manager moves the AWSCURRENT label to the new version whenever the active secret value changes, whether from a manual update or automatic rotation. This event is enabled by default for all secrets and routed to the default EventBridge event bus. To consume it, you add an event pattern that matches it, as shown in the following example.

{
    "source": ["aws.secretsmanager"],
    "detail-type": ["Secret Label Updated"],
    "detail": {
        "labelUpdated": ["AWSCURRENT"]
    }
}

For more information about the Secret Label Updated event, see Secret event notifications.

Alternatively, you can match CloudTrail log entries for the operations that change a secret value. Some of these events are from Secrets Manager operations and some are generated by the Secrets Manager service. You must include the detail-type for both. The following example shows an EventBridge event pattern that matches these CloudTrail log entries.

{
    "source": ["aws.secretsmanager"],
    "detail-type": [
        "AWS API Call via CloudTrail",
        "AWS Service Event via CloudTrail"
    ],
    "detail": {
        "eventSource": ["secretsmanager.amazonaws.com"],
        "eventName": ["PutSecretValue", "UpdateSecret", "RotationSucceeded"]
    }
}