---
id: aws-cdk-aws-secretsmanager
version: "1.204.0"
license: Apache-2.0
license_treatment: permissive
maintenance: active
---

# aws-cdk.aws-secretsmanager — The CDK Construct Library for AWS::SecretsManager

License: permissive · Maintenance: active · Downloads: 151.5K/mo

## What it is and what it does

This is the AWS CDK v1 construct library for AWS Secrets Manager, a service for storing and rotating database credentials, API keys, and other secrets in AWS. It provides Python classes to define secrets as infrastructure-as-code, configure automatic rotation via Lambda functions or hosted rotation for databases like MySQL and PostgreSQL, and grant read/write permissions to IAM roles and principals.

The library integrates with AWS KMS for encryption, supports importing existing secrets by ARN or name, and handles cross-account access through resource and KMS key policies. However, AWS CDK v1 reached end-of-support on 2023-06-01, and the package is no longer being updated; users are directed to migrate to AWS CDK v2.

Use it for:

- Define and provision database credentials as CDK constructs, with automatic secret generation and KMS encryption.
- Set up automated secret rotation schedules using custom Lambda functions or AWS-hosted rotation for MySQL, PostgreSQL, Oracle, and other databases.
- Grant IAM roles and cross-account principals read and write permissions to secrets with automatic KMS key policy updates.
- Import existing secrets from AWS Secrets Manager by ARN or name into a CDK stack for reference in other constructs.
- Manage database credential rotation in VPC-deployed environments using hosted rotation with network connectivity rules.

## Worth the install?

AI-flagged interpretation of the facts above — verify before relying.

AWS CDK construct library for provisioning and managing AWS Secrets Manager resources—creating secrets, configuring rotation schedules, and granting access permissions through infrastructure-as-code.

No—do not install. This package is end-of-support as of 2023-06-01 and explicitly deprecated in favor of AWS CDK v2. While it has low install friction and no known vulnerabilities, using an unsupported major version of AWS CDK introduces technical debt and blocks access to bug fixes and security updates. Migrate to aws-cdk-lib.aws_secretsmanager (CDK v2) instead.

## Install

pip install aws-cdk-aws-secretsmanager
uv add aws-cdk-aws-secretsmanager
poetry add aws-cdk-aws-secretsmanager

## Installing aws-cdk.aws-secretsmanager

Before you install: Low install friction with 11 runtime dependencies, all AWS CDK modules and supporting libraries. However, the package is explicitly end-of-support as of 2023-06-01; the description banner states AWS CDK v1 has reached End-of-Support and users should migrate to AWS CDK v2. Active repository maintenance does not offset the deprecated status.

License in practice: Licensed under Apache-2.0 (permissive), allowing commercial use, modification, and distribution with minimal restrictions—standard for AWS CDK libraries.

Quickstart:

pip install aws-cdk.aws-secretsmanager

import aws_cdk.aws_secretsmanager as secretsmanager

secret = secretsmanager.Secret(self, "Secret")
secret.grant_read(role)

Requires AWS CDK v1 environment; v1 is end-of-support as of 2023-06-01 and users should migrate to AWS CDK v2 instead.

Verify before relying:

- Whether AWS CDK v2 equivalent (aws-cdk-lib.aws_secretsmanager) is recommended as a drop-in replacement or requires code changes.
- Current security patch status and timeline for v1 end-of-life support.

## Package facts

- License: Apache-2.0 (permissive)
- Python support: supports_current
- Install friction: low
- Maintenance: active
- Downloads: 151.5K/month (top 15,000 on PyPI)
- Known vulnerabilities: none known

## Tags

aws secrets manager cdk, infrastructure as code secrets, aws secret rotation, cdk construct library, aws credential management, secrets provisioning automation, iam secret grants, aws-cdk, deprecated-v1, infrastructure-as-code

[View on SkillFed](https://skillfed.io/packages/aws-cdk-aws-secretsmanager) · [View on PyPI](https://pypi.org/project/aws-cdk-aws-secretsmanager/)