Secrets

Emulates a managed secret store — the Secrets Manager vault you'd keep database passwords, API keys, and tokens in instead of hardcoding them. You create a named secret with a value, read it back, and update it to roll a new version.

Reach for it in tests when your code fetches a secret at startup, reads a specific version, or rotates a credential — so you can exercise those paths without a live vault. Under the hood each secret is a named entry with a value and a version history that grows on every update.

Create a secret#

A secret is the named entry your value lives in — the equivalent of creating a secret in Secrets Manager. Tags let you organise them the way you would in the real service:

import secdriver "github.com/stackshy/cloudemu/v2/services/secrets/driver"

aws.SecretsManager.CreateSecret(ctx, secdriver.SecretConfig{
    Name:  "db-password",
    Value: "super-secret-123",
    Tags:  map[string]string{"env": "production"},
})

Read a secret#

GetSecret returns the current value — the call your app makes at startup to pull a credential out of the vault:

secret, _ := aws.SecretsManager.GetSecret(ctx, "db-password")
fmt.Println(secret.Value) // "super-secret-123"

Update and read a specific version#

Every update creates a new version rather than overwriting in place, so you can roll a credential and still read older versions — the mechanism behind secret rotation:

// Update creates a new version
aws.SecretsManager.UpdateSecret(ctx, "db-password", "new-password-456")

// Get specific version
secret, _ = aws.SecretsManager.GetSecretVersion(ctx, "db-password", "v2")

List secrets#

ListSecrets enumerates every secret in the store, the way an inventory or admin view would:

secrets, _ := aws.SecretsManager.ListSecrets(ctx)

Behavior & fidelity#

SDK-compat — Live#

Real Secrets Manager, Key Vault, and Secret Manager clients drive it end-to-end. See SDK-Compat for the full operation list.