| 1 | import * as secretsmanager from "@distilled.cloud/aws/secrets-manager"; |
| 2 | import * as Effect from "effect/Effect"; |
| 3 | import * as Binding from "../../Binding.ts"; |
| 4 | import type { Secret } from "./Secret.ts"; |
| 5 | |
| 6 | export interface GetSecretValueRequest extends Omit< |
| 7 | secretsmanager.GetSecretValueRequest, |
| 8 | "SecretId" |
| 9 | > {} |
| 10 | |
| 11 | /** |
| 12 | * Runtime binding for `secretsmanager:GetSecretValue`. |
| 13 | * |
| 14 | * Bind this operation to a `Secret` in the function's init phase to get a |
| 15 | * callable that reads the current (or a specific) secret version — the secret |
| 16 | * ARN is injected automatically and `secretsmanager:GetSecretValue` is |
| 17 | * granted on the secret. Provide the implementation with |
| 18 | * `Effect.provide(AWS.SecretsManager.GetSecretValueHttp)`. |
| 19 | * |
| 20 | * Secret values are sensitive: `SecretString` / `SecretBinary` may be handed |
| 21 | * back wrapped in `Redacted` — unwrap with `Redacted.value` before use. |
| 22 | * |
| 23 | * AWS lists `secretsmanager:GetSecretValue` as the required permission for |
| 24 | * retrieving the value; `DescribeSecret` is metadata-only and is not needed. |
| 25 | * If the secret uses a customer-managed KMS key, the caller additionally |
| 26 | * needs `kms:Decrypt` for that key. See the [GetSecretValue API](https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_GetSecretValue.html) |
| 27 | * and [Secrets Manager authorization reference](https://docs.aws.amazon.com/service-authorization/latest/reference/list_secretsmanager.html). |
| 28 | * ### Reading Secret Values |
| 29 | * **Example:** Read the Current Secret Value |
| 30 | * ```typescript |
| 31 | * // init — bind the operation to the secret |
| 32 | * const secret = yield* AWS.SecretsManager.Secret("DbPassword", { |
| 33 | * secretString: Redacted.make("initial-password"), |
| 34 | * }); |
| 35 | * const getSecretValue = yield* AWS.SecretsManager.GetSecretValue(secret); |
| 36 | * |
| 37 | * // runtime — reads the AWSCURRENT version |
| 38 | * const result = yield* getSecretValue(); |
| 39 | * const value = |
| 40 | * typeof result.SecretString === "string" |
| 41 | * ? result.SecretString |
| 42 | * : Redacted.value(result.SecretString!); |
| 43 | * ``` |
| 44 | * |
| 45 | * @see https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_GetSecretValue.html |
| 46 | * @see https://docs.aws.amazon.com/service-authorization/latest/reference/list_secretsmanager.html |
| 47 | * |
| 48 | * @binding |
| 49 | */ |
| 50 | export interface GetSecretValue extends Binding.Service< |
| 51 | GetSecretValue, |
| 52 | "AWS.SecretsManager.GetSecretValue", |
| 53 | ( |
| 54 | secret: Secret, |
| 55 | ) => Effect.Effect< |
| 56 | ( |
| 57 | request?: GetSecretValueRequest, |
| 58 | ) => Effect.Effect< |
| 59 | secretsmanager.GetSecretValueResponse, |
| 60 | secretsmanager.GetSecretValueError |
| 61 | > |
| 62 | > |
| 63 | > {} |
| 64 | |
| 65 | export const GetSecretValue = Binding.Service<GetSecretValue>( |
| 66 | "AWS.SecretsManager.GetSecretValue", |
| 67 | ); |