Skip to content

Terraform AWS Secrets Manager

Secrets, secret versions, rotation schedules, KMS encryption, resource policies, replication, and controlled retrieval of database passwords, API keys, and tokens.

1 controls enforced7 frameworks

Controls Enforced

The following compliance controls are enforced by this module at terraform plan time.

Quick Start

module "secrets_manager" {
  source  = "acscessentialeight.compliance.tf/terraform-aws-modules/secrets-manager/aws"
  version = "<version>"

  # ... your arguments here
}

module "secrets_manager" {
  source  = "acscism2023.compliance.tf/terraform-aws-modules/secrets-manager/aws"
  version = "<version>"

  # ... your arguments here
}

module "secrets_manager" {
  source  = "awscontroltower.compliance.tf/terraform-aws-modules/secrets-manager/aws"
  version = "<version>"

  # ... your arguments here
}

module "secrets_manager" {
  source  = "awsgenai.compliance.tf/terraform-aws-modules/secrets-manager/aws"
  version = "<version>"

  # ... your arguments here
}

module "secrets_manager" {
  source  = "awswellarchitected.compliance.tf/terraform-aws-modules/secrets-manager/aws"
  version = "<version>"

  # ... your arguments here
}

module "secrets_manager" {
  source  = "cccsmedium.compliance.tf/terraform-aws-modules/secrets-manager/aws"
  version = "<version>"

  # ... your arguments here
}

module "secrets_manager" {
  source  = "cfrpart11.compliance.tf/terraform-aws-modules/secrets-manager/aws"
  version = "<version>"

  # ... your arguments here
}

module "secrets_manager" {
  source  = "cis.compliance.tf/terraform-aws-modules/secrets-manager/aws"
  version = "<version>"

  # ... your arguments here
}

module "secrets_manager" {
  source  = "cisv500.compliance.tf/terraform-aws-modules/secrets-manager/aws"
  version = "<version>"

  # ... your arguments here
}

module "secrets_manager" {
  source  = "cisv600.compliance.tf/terraform-aws-modules/secrets-manager/aws"
  version = "<version>"

  # ... your arguments here
}

module "secrets_manager" {
  source  = "cisv80ig1.compliance.tf/terraform-aws-modules/secrets-manager/aws"
  version = "<version>"

  # ... your arguments here
}

module "secrets_manager" {
  source  = "cisacyberessentials.compliance.tf/terraform-aws-modules/secrets-manager/aws"
  version = "<version>"

  # ... your arguments here
}

module "secrets_manager" {
  source  = "eugmpannex11.compliance.tf/terraform-aws-modules/secrets-manager/aws"
  version = "<version>"

  # ... your arguments here
}

module "secrets_manager" {
  source  = "fedramplow.compliance.tf/terraform-aws-modules/secrets-manager/aws"
  version = "<version>"

  # ... your arguments here
}

module "secrets_manager" {
  source  = "fedrampmoderate.compliance.tf/terraform-aws-modules/secrets-manager/aws"
  version = "<version>"

  # ... your arguments here
}

module "secrets_manager" {
  source  = "ffiec.compliance.tf/terraform-aws-modules/secrets-manager/aws"
  version = "<version>"

  # ... your arguments here
}

module "secrets_manager" {
  source  = "gdpr.compliance.tf/terraform-aws-modules/secrets-manager/aws"
  version = "<version>"

  # ... your arguments here
}

module "secrets_manager" {
  source  = "hipaa.compliance.tf/terraform-aws-modules/secrets-manager/aws"
  version = "<version>"

  # ... your arguments here
}

module "secrets_manager" {
  source  = "iso27001.compliance.tf/terraform-aws-modules/secrets-manager/aws"
  version = "<version>"

  # ... your arguments here
}

module "secrets_manager" {
  source  = "nis2.compliance.tf/terraform-aws-modules/secrets-manager/aws"
  version = "<version>"

  # ... your arguments here
}

module "secrets_manager" {
  source  = "nist800171.compliance.tf/terraform-aws-modules/secrets-manager/aws"
  version = "<version>"

  # ... your arguments here
}

module "secrets_manager" {
  source  = "nist80053.compliance.tf/terraform-aws-modules/secrets-manager/aws"
  version = "<version>"

  # ... your arguments here
}

module "secrets_manager" {
  source  = "nistcsf.compliance.tf/terraform-aws-modules/secrets-manager/aws"
  version = "<version>"

  # ... your arguments here
}

module "secrets_manager" {
  source  = "nydfs23.compliance.tf/terraform-aws-modules/secrets-manager/aws"
  version = "<version>"

  # ... your arguments here
}

module "secrets_manager" {
  source  = "pcidss.compliance.tf/terraform-aws-modules/secrets-manager/aws"
  version = "<version>"

  # ... your arguments here
}

module "secrets_manager" {
  source  = "rbicybersecurity.compliance.tf/terraform-aws-modules/secrets-manager/aws"
  version = "<version>"

  # ... your arguments here
}

module "secrets_manager" {
  source  = "rbiitfnbfc.compliance.tf/terraform-aws-modules/secrets-manager/aws"
  version = "<version>"

  # ... your arguments here
}

module "secrets_manager" {
  source  = "soc2.compliance.tf/terraform-aws-modules/secrets-manager/aws"
  version = "<version>"

  # ... your arguments here
}

See the Get Started guide to get started and read the Features section for more details on how to customize the module for your requirements.

Migration from Upstream

Already using terraform-aws-modules? Change only the source URL:

module "secrets_manager" {
  source  = "terraform-aws-modules/secrets-manager/aws"
  version = "1.0"
}

module "secrets_manager" {
  source  = "soc2.compliance.tf/terraform-aws-modules/secrets-manager/aws"
  version = "1.0"
}

Same arguments. Same outputs. Compliance controls are enforced automatically at terraform plan. If a required value is missing, you get a clear validation error telling you what to set.

See the Migration Guide for step-by-step instructions.

Reversibility

No lock-in. Switch back by reverting the source URL to the upstream path:

module "secrets_manager" {
  source  = "terraform-aws-modules/secrets-manager/aws"
}

Run terraform init -upgrade. Terraform state is unchanged — same resource addresses, same provider, no compliance.tf-specific resources. Controls you already applied remain in AWS.

Mapped compliance frameworks

SC-12(3): Asymmetric Keys

11.30 Controls for open systems

7.1 Data Storage - Damage Protection

164.312(e)(2)(ii) Encryption

500.15(a)

8.3.2: Strong cryptography is used to render all authentication factors unreadable during transmission and storage on all system components

Framework Coverage

Which controls from this module are active under each framework endpoint. ● enforced by default · ○ not activated by this endpoint

ControlCCCS Medium Cloud Control ProfileTitle 21 CFR Part 11EU GMP Annex 11HIPAA Omnibus Rule 2013NIST SP 800-53 Rev 5NYDFS Cybersecurity RegulationPCI DSS v4.0
Secrets Manager secrets should be encrypted using CMK●●●●●●●

Showing top 7 frameworks by coverage. All framework endpoints →