[ aws . secretsmanager ]
Lists the secrets that are stored by Secrets Manager in the Amazon Web Services account, not including secrets that are marked for deletion. To see secrets marked for deletion, use the Secrets Manager console.
ListSecrets is eventually consistent, however it might not reflect changes from the last five minutes. To get the latest information for a specific secret, use DescribeSecret .
To list the versions of a secret, use ListSecretVersionIds .
To get the secret value from SecretString
or SecretBinary
, call GetSecretValue .
For information about finding secrets in the console, see Find secrets in Secrets Manager .
Secrets Manager generates a CloudTrail log entry when you call this action. Do not include sensitive information in request parameters because it might be logged. For more information, see Logging Secrets Manager events with CloudTrail .
Required permissions:
secretsmanager:ListSecrets
. For more information, see IAM policy actions for Secrets Manager and Authentication and access control in Secrets Manager .
See also: AWS API Documentation
list-secrets
is a paginated operation. Multiple API calls may be issued in order to retrieve the entire data set of results. You can disable pagination by providing the --no-paginate
argument.
When using --output text
and the --query
argument on a paginated response, the --query
argument must extract data from the results of the following query expressions: SecretList
list-secrets
[--include-planned-deletion | --no-include-planned-deletion]
[--filters <value>]
[--sort-order <value>]
[--cli-input-json | --cli-input-yaml]
[--starting-token <value>]
[--page-size <value>]
[--max-items <value>]
[--generate-cli-skeleton <value>]
[--debug]
[--endpoint-url <value>]
[--no-verify-ssl]
[--no-paginate]
[--output <value>]
[--query <value>]
[--profile <value>]
[--region <value>]
[--version <value>]
[--color <value>]
[--no-sign-request]
[--ca-bundle <value>]
[--cli-read-timeout <value>]
[--cli-connect-timeout <value>]
[--cli-binary-format <value>]
[--no-cli-pager]
[--cli-auto-prompt]
[--no-cli-auto-prompt]
--include-planned-deletion
| --no-include-planned-deletion
(boolean)
Specifies whether to include secrets scheduled for deletion.
--filters
(list)
The filters to apply to the list of secrets.
(structure)
Allows you to add filters when you use the search function in Secrets Manager. For more information, see Find secrets in Secrets Manager .
Key -> (string)
The following are keys you can use:
description : Prefix match, not case-sensitive.
name : Prefix match, case-sensitive.
tag-key : Prefix match, case-sensitive.
tag-value : Prefix match, case-sensitive.
primary-region : Prefix match, case-sensitive.
owning-service : Prefix match, case-sensitive.
all : Breaks the filter value string into words and then searches all attributes for matches. Not case-sensitive.
Values -> (list)
The keyword to filter for.
You can prefix your search value with an exclamation mark (
!
) in order to perform negation filters.(string)
Shorthand Syntax:
Key=string,Values=string,string ...
JSON Syntax:
[
{
"Key": "description"|"name"|"tag-key"|"tag-value"|"primary-region"|"owning-service"|"all",
"Values": ["string", ...]
}
...
]
--sort-order
(string)
Secrets are listed by
CreatedDate
.Possible values:
asc
desc
--cli-input-json
| --cli-input-yaml
(string)
Reads arguments from the JSON string provided. The JSON string follows the format provided by --generate-cli-skeleton
. If other arguments are provided on the command line, those values will override the JSON-provided values. It is not possible to pass arbitrary binary values using a JSON-provided value as the string will be taken literally. This may not be specified along with --cli-input-yaml
.
--starting-token
(string)
A token to specify where to start paginating. This is the
NextToken
from a previously truncated response.For usage examples, see Pagination in the AWS Command Line Interface User Guide .
--page-size
(integer)
The size of each page to get in the AWS service call. This does not affect the number of items returned in the command’s output. Setting a smaller page size results in more calls to the AWS service, retrieving fewer items in each call. This can help prevent the AWS service calls from timing out.
For usage examples, see Pagination in the AWS Command Line Interface User Guide .
--max-items
(integer)
The total number of items to return in the command’s output. If the total number of items available is more than the value specified, a
NextToken
is provided in the command’s output. To resume pagination, provide theNextToken
value in thestarting-token
argument of a subsequent command. Do not use theNextToken
response element directly outside of the AWS CLI.For usage examples, see Pagination in the AWS Command Line Interface User Guide .
--generate-cli-skeleton
(string)
Prints a JSON skeleton to standard output without sending an API request. If provided with no value or the value input
, prints a sample input JSON that can be used as an argument for --cli-input-json
. Similarly, if provided yaml-input
it will print a sample input YAML that can be used with --cli-input-yaml
. If provided with the value output
, it validates the command inputs and returns a sample output JSON for that command. The generated JSON skeleton is not stable between versions of the AWS CLI and there are no backwards compatibility guarantees in the JSON skeleton generated.
--debug
(boolean)
Turn on debug logging.
--endpoint-url
(string)
Override command’s default URL with the given URL.
--no-verify-ssl
(boolean)
By default, the AWS CLI uses SSL when communicating with AWS services. For each SSL connection, the AWS CLI will verify SSL certificates. This option overrides the default behavior of verifying SSL certificates.
--no-paginate
(boolean)
Disable automatic pagination.
--output
(string)
The formatting style for command output.
json
text
table
yaml
yaml-stream
--query
(string)
A JMESPath query to use in filtering the response data.
--profile
(string)
Use a specific profile from your credential file.
--region
(string)
The region to use. Overrides config/env settings.
--version
(string)
Display the version of this tool.
--color
(string)
Turn on/off color output.
on
off
auto
--no-sign-request
(boolean)
Do not sign requests. Credentials will not be loaded if this argument is provided.
--ca-bundle
(string)
The CA certificate bundle to use when verifying SSL certificates. Overrides config/env settings.
--cli-read-timeout
(int)
The maximum socket read time in seconds. If the value is set to 0, the socket read will be blocking and not timeout. The default value is 60 seconds.
--cli-connect-timeout
(int)
The maximum socket connect time in seconds. If the value is set to 0, the socket connect will be blocking and not timeout. The default value is 60 seconds.
--cli-binary-format
(string)
The formatting style to be used for binary blobs. The default format is base64. The base64 format expects binary blobs to be provided as a base64 encoded string. The raw-in-base64-out format preserves compatibility with AWS CLI V1 behavior and binary values must be passed literally. When providing contents from a file that map to a binary blob fileb://
will always be treated as binary and use the file contents directly regardless of the cli-binary-format
setting. When using file://
the file contents will need to properly formatted for the configured cli-binary-format
.
base64
raw-in-base64-out
--no-cli-pager
(boolean)
Disable cli pager for output.
--cli-auto-prompt
(boolean)
Automatically prompt for CLI input parameters.
--no-cli-auto-prompt
(boolean)
Disable automatically prompt for CLI input parameters.
Note
To use the following examples, you must have the AWS CLI installed and configured. See the Getting started guide in the AWS CLI User Guide for more information.
Unless otherwise stated, all examples have unix-like quotation rules. These examples will need to be adapted to your terminal’s quoting rules. See Using quotation marks with strings in the AWS CLI User Guide .
Example 1: To list the secrets in your account
The following list-secrets
example gets a list of the secrets in your account.
aws secretsmanager list-secrets
Output:
{
"SecretList": [
{
"ARN": "arn:aws:secretsmanager:us-west-2:123456789012:secret:MyTestSecret-a1b2c3",
"Name": "MyTestSecret",
"LastChangedDate": 1523477145.729,
"SecretVersionsToStages": {
"a1b2c3d4-5678-90ab-cdef-EXAMPLE11111": [
"AWSCURRENT"
]
}
},
{
"ARN": "arn:aws:secretsmanager:us-west-2:123456789012:secret:AnotherSecret-d4e5f6",
"Name": "AnotherSecret",
"LastChangedDate": 1523482025.685,
"SecretVersionsToStages": {
"a1b2c3d4-5678-90ab-cdef-EXAMPLE22222": [
"AWSCURRENT"
]
}
}
]
}
For more information, see Find a secret in the Secrets Manager User Guide.
Example 2: To filter the list of secrets in your account
The following list-secrets
example gets a list of the secrets in your account that have Test
in the name. Filtering by name is case sensitive.
aws secretsmanager list-secrets \
--filter Key="name",Values="Test"
Output:
{
"SecretList": [
{
"ARN": "arn:aws:secretsmanager:us-west-2:123456789012:secret:MyTestSecret-a1b2c3",
"Name": "MyTestSecret",
"LastChangedDate": 1523477145.729,
"SecretVersionsToStages": {
"a1b2c3d4-5678-90ab-cdef-EXAMPLE11111": [
"AWSCURRENT"
]
}
}
]
}
For more information, see Find a secret in the Secrets Manager User Guide.
SecretList -> (list)
A list of the secrets in the account.
(structure)
A structure that contains the details about a secret. It does not include the encrypted
SecretString
andSecretBinary
values. To get those values, use GetSecretValue .ARN -> (string)
The Amazon Resource Name (ARN) of the secret.
Name -> (string)
The friendly name of the secret. You can use forward slashes in the name to represent a path hierarchy. For example,
/prod/databases/dbserver1
could represent the secret for a server nameddbserver1
in the folderdatabases
in the folderprod
.Description -> (string)
The user-provided description of the secret.
KmsKeyId -> (string)
The ARN of the KMS key that Secrets Manager uses to encrypt the secret value. If the secret is encrypted with the Amazon Web Services managed key
aws/secretsmanager
, this field is omitted.RotationEnabled -> (boolean)
Indicates whether automatic, scheduled rotation is enabled for this secret.
RotationLambdaARN -> (string)
The ARN of an Amazon Web Services Lambda function invoked by Secrets Manager to rotate and expire the secret either automatically per the schedule or manually by a call to `
RotateSecret
https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_RotateSecret.html`__ .RotationRules -> (structure)
A structure that defines the rotation configuration for the secret.
AutomaticallyAfterDays -> (long)
The number of days between rotations of the secret. You can use this value to check that your secret meets your compliance guidelines for how often secrets must be rotated. If you use this field to set the rotation schedule, Secrets Manager calculates the next rotation date based on the previous rotation. Manually updating the secret value by calling
PutSecretValue
orUpdateSecret
is considered a valid rotation.In
DescribeSecret
andListSecrets
, this value is calculated from the rotation schedule after every successful rotation. InRotateSecret
, you can set the rotation schedule inRotationRules
withAutomaticallyAfterDays
orScheduleExpression
, but not both. To set a rotation schedule in hours, useScheduleExpression
.Duration -> (string)
The length of the rotation window in hours, for example
3h
for a three hour window. Secrets Manager rotates your secret at any time during this window. The window must not extend into the next rotation window or the next UTC day. The window starts according to theScheduleExpression
. If you don’t specify aDuration
, for aScheduleExpression
in hours, the window automatically closes after one hour. For aScheduleExpression
in days, the window automatically closes at the end of the UTC day. For more information, including examples, see Schedule expressions in Secrets Manager rotation in the Secrets Manager Users Guide .ScheduleExpression -> (string)
A
cron()
orrate()
expression that defines the schedule for rotating your secret. Secrets Manager rotation schedules use UTC time zone. Secrets Manager rotates your secret any time during a rotation window.Secrets Manager
rate()
expressions represent the interval in hours or days that you want to rotate your secret, for examplerate(12 hours)
orrate(10 days)
. You can rotate a secret as often as every four hours. If you use arate()
expression, the rotation window starts at midnight. For a rate in hours, the default rotation window closes after one hour. For a rate in days, the default rotation window closes at the end of the day. You can set theDuration
to change the rotation window. The rotation window must not extend into the next UTC day or into the next rotation window.You can use a
cron()
expression to create a rotation schedule that is more detailed than a rotation interval. For more information, including examples, see Schedule expressions in Secrets Manager rotation in the Secrets Manager Users Guide . For a cron expression that represents a schedule in hours, the default rotation window closes after one hour. For a cron expression that represents a schedule in days, the default rotation window closes at the end of the day. You can set theDuration
to change the rotation window. The rotation window must not extend into the next UTC day or into the next rotation window.LastRotatedDate -> (timestamp)
The most recent date and time that the Secrets Manager rotation process was successfully completed. This value is null if the secret hasn’t ever rotated.
LastChangedDate -> (timestamp)
The last date and time that this secret was modified in any way.
LastAccessedDate -> (timestamp)
The date that the secret was last accessed in the Region. This field is omitted if the secret has never been retrieved in the Region.
DeletedDate -> (timestamp)
The date and time the deletion of the secret occurred. Not present on active secrets. The secret can be recovered until the number of days in the recovery window has passed, as specified in the
RecoveryWindowInDays
parameter of the `DeleteSecret
https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_DeleteSecret.html`__ operation.NextRotationDate -> (timestamp)
The next date and time that Secrets Manager will attempt to rotate the secret, rounded to the nearest hour. This value is null if the secret is not set up for rotation.
Tags -> (list)
The list of user-defined tags associated with the secret. To add tags to a secret, use `
TagResource
https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_TagResource.html`__ . To remove tags, use `UntagResource
https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_UntagResource.html`__ .(structure)
A structure that contains information about a tag.
Key -> (string)
The key identifier, or name, of the tag.
Value -> (string)
The string value associated with the key of the tag.
SecretVersionsToStages -> (map)
A list of all of the currently assigned
SecretVersionStage
staging labels and theSecretVersionId
attached to each one. Staging labels are used to keep track of the different versions during the rotation process.Note
A version that does not have any
SecretVersionStage
is considered deprecated and subject to deletion. Such versions are not included in this list.key -> (string)
value -> (list)
(string)
OwningService -> (string)
Returns the name of the service that created the secret.
CreatedDate -> (timestamp)
The date and time when a secret was created.
PrimaryRegion -> (string)
The Region where Secrets Manager originated the secret.
NextToken -> (string)
Secrets Manager includes this value if there’s more output available than what is included in the current response. This can occur even when the response includes no values at all, such as when you ask for a filtered view of a long list. To get the next results, call
ListSecrets
again with this value.