Skip to content
Documentation
Contact
← Back to documentation
Technical Reference

AWS Secrets Manager

AWS Secrets Manager integration for Flows360 workflows.

CategoryDeveloper Tools
Authenticationcustom
Version0.2.0
Published scopes0 published scopes
Last updatedSeptember 19, 2026

Overview

Connect AWS Secrets Manager with Flows360

AWS Secrets Manager integration for Flows360 workflows.

Use the AWS Secrets Manager connector to include its declared actions and events in Flows360 workflows without duplicating the integration logic inside each consuming system. This pinned connector version currently exposes 6 actions and no declared triggers.

Available actions

  • Create Secret
  • Get Secret Value
  • Update Secret
  • Delete Secret
  • Find Secret
  • Generate Random Password

Available triggers

  • No triggers are declared in this pinned package.

The capability list above is generated from the exact reviewed connector package so the public description stays aligned with the version Flows360 operates.

Technical guide

Technical reference

Package identity

  • Connector: AWS Secrets Manager
  • Package: @activepieces/piece-amazon-secrets-manager@0.2.0
  • Exact artifact digest: sha256:ea267a4e661859926b2172e6baaaed6215b3b90585a0618e71c7cd0cebbeee7a
  • Runtime: Activepieces-compatible deterministic worker
  • Source: the exact reviewed Activepieces source

Authentication

CUSTOM AUTH, OIDC. Connection values are tenant-specific and remain in the consuming Studio instance; CDK stores definitions and field metadata, not customer credential values.

Action contracts

  • Create Secret (createSecret), Creates a new secret. Classification: read.
  • Get Secret Value (getSecretValue), Retrieves a secret value. Classification: read.
  • Update Secret (updateSecret), Updates an existing secret. Classification: read.
  • Delete Secret (deleteSecret), Deletes an existing secret. Classification: read.
  • Find Secret (findSecret), Finds an existing secret using filters. Classification: read.
  • Generate Random Password (getARandomPassword), Generates a random password using AWS Secrets Manager. Classification: read.

Trigger contracts

  • No trigger delivery contracts are declared.

Verification

Deterministic execution evidence is recorded for the pinned artifact, including 1 exercised action entrypoint and 0 exercised trigger entrypoints.

Capability summary

Authenticationcustom
Supported objects6
Supported actions6
TriggersNone published

Authentication

Authentication method: custom

Authentication profiles

connection · custom
  • Access Key ID Required · protected credential
  • Secret Access Key Required · protected credential
  • Region Required
connection_2 · custom
  • Role ARN Required
  • Region Required

Supported objects

ObjectReadWriteNotes
Create Secret Yes No Creates a new secret.
Get Secret Value Yes No Retrieves a secret value.
Update Secret Yes No Updates an existing secret.
Delete Secret Yes No Deletes an existing secret.
Find Secret Yes No Finds an existing secret using filters.
Generate Random Password Yes No Generates a random password using AWS Secrets Manager.

Supported actions

Create Secret · Read

Creates a new secret.

create_secret · Risk: low · Retry: safe

Inputs

  • name · string · Required, The name of the secret
  • secretValue · string · Required, The secret value (text)
  • description · string · Optional, A description of the secret (optional)
  • tags · array · Optional, Tags
Get Secret Value · Read

Retrieves a secret value.

get_secret_value · Risk: low · Retry: safe

Inputs

  • secretId · string · Required, The name or ARN of the secret
  • versionId · string · Optional, The unique identifier of the version (optional)
  • versionStage · string · Optional, The staging label to retrieve (defaults to AWSCURRENT)
Update Secret · Read

Updates an existing secret.

update_secret · Risk: low · Retry: safe

Inputs

  • secretId · string · Required, The name or ARN of the secret
  • secretValue · string · Required, The new secret value (text)
  • description · string · Optional, Updated description of the secret (optional)
  • clientRequestToken · string · Optional, A unique token to ensure idempotency (optional)
Delete Secret · Read

Deletes an existing secret.

delete_secret · Risk: low · Retry: safe

Inputs

  • secretId · string · Required, The name or ARN of the secret
  • recoveryWindowInDays · number · Optional, The number of days before the secret is permanently deleted (7-30, default 30). Set to 0 for immediate deletion.
  • forceDeleteWithoutRecovery · boolean · Optional, If enabled, the secret is deleted immediately without a recovery window
Find Secret · Read

Finds an existing secret using filters.

find_secret · Risk: low · Retry: safe

Inputs

  • filterKey · string · Required, The field to filter by
  • filterValue · string · Required, The value to search for
  • maxResults · number · Optional, Maximum number of results to return (1-100)
  • sortBy · string · Optional, Sort results by
  • sortOrder · string · Optional, Sort order for results
Generate Random Password · Read

Generates a random password using AWS Secrets Manager.

get_arandom_password · Risk: low · Retry: safe

Inputs

  • passwordLength · number · Optional, The length of the password (default: 32)
  • excludeCharacters · string · Optional, Characters to exclude from the password
  • excludeNumbers · boolean · Optional, Exclude numbers from the password
  • excludePunctuation · boolean · Optional, Exclude punctuation from the password
  • excludeUppercase · boolean · Optional, Exclude uppercase letters from the password
  • excludeLowercase · boolean · Optional, Exclude lowercase letters from the password
  • includeSpace · boolean · Optional, Include space character in the password
  • requireEachIncludedType · boolean · Optional, Require at least one of each included character type

Setup

Setup

  1. Add the AWS Secrets Manager connector to the workflow in the target Flows360 Studio instance.
  2. Create or select the tenant-specific connection required by the connector. Connection secrets remain in the Studio connection boundary and are not copied into CDK documentation.
  3. Provide the connection fields declared by the pinned package:
  • Access Key ID (accessKeyId), required; stored as a sensitive connection value.
  • Secret Access Key (secretAccessKey), required; stored as a sensitive connection value.
  • Region (region), required.
  • Role ARN (roleArn), required.
  • Region (region), required.
  1. Select the required action or trigger and complete its declared input fields. Required and optional inputs are defined by the exact package schema.
  2. Test the workflow in the appropriate environment before enabling production scheduling or event delivery.

Limitations

Limitations and operational notes

  • This content describes @activepieces/piece-amazon-secrets-manager@0.2.0; provider behaviour can change independently and should be revalidated when the provider or connector version changes.
  • Only the 6 actions and 0 triggers declared by this pinned package are represented here.
  • Tenant credentials and connection values are not stored in the public connector record.
  • Provider-side permissions, account entitlements, quotas and rate limits remain subject to the connected provider account and are not inferred when the package does not declare them.
  • Deterministic execution evidence is recorded for the pinned artifact, including 1 exercised action entrypoint and 0 exercised trigger entrypoints.

Troubleshooting

Why canu2019t the connector authenticate?

Check the tenant connection in Studio and confirm every required AWS Secrets Manager connection field is present. Re-authorise OAuth-based connections if the provider token or consent has expired. Do not place credential values in CDK content or logs.

Why is an action or trigger unavailable?

Confirm that the workflow is using @activepieces/piece-amazon-secrets-manager@0.2.0 and compare the requested capability with the declared action and trigger list for this version. A capability that is not declared by the pinned package should not be presented as supported.

What should I check after a provider-side change?

Revalidate authentication, required fields, action/trigger behaviour and provider documentation before publishing refreshed connector content or moving a new package version into production.

github.com