SecretsManagerClient on Grafana Labs

createSecret

Mon, 21 Sep 2026 15:16:28 +0000

createSecret

SecretsManagerClient.createSecret creates a secret in AWS’ secrets manager.

Parameters

Parameter	Type	Description
name	string	The friendly name of the secret. You can use forward slashes in the name to represent a path hierarchy.
secretString	string	The text data to encrypt and store in this new version of the secret. We recommend you use a JSON structure of key/value pairs for your secret value.
description	string	The description of the secret.
versionID (optional)	string	Optional unique version identifier for the created secret. If no versionID is provided, an auto-generated UUID will be used instead.
tags (optional)	Array<{“key”: “value”},>	A list of tags to attach to the secret. Each tag is a key and value pair of strings in a JSON text string

Returns

Type	Description
Promise< Secret>	A Promise that fulfills with a Secret object that contains the details of the created secret.

Example

import {
  AWSConfig,
  SecretsManagerClient,
} from 'https://jslib.k6.io/aws/0.14.0/secrets-manager.js';

const awsConfig = new AWSConfig({
  region: __ENV.AWS_REGION,
  accessKeyId: __ENV.AWS_ACCESS_KEY_ID,
  secretAccessKey: __ENV.AWS_SECRET_ACCESS_KEY,
});

const secretsManager = new SecretsManagerClient(awsConfig);
const testSecretName = 'jslib-test-secret';
const testSecretValue = 'jslib-test-value';

export default async function () {
  // Let's create our test secret.
  const testSecret = await secretsManager.createSecret(
    testSecretName,
    testSecretValue,
    'this is a test secret, delete me.'
  );

  // Let's get its value and verify it was indeed created.
  const createdSecret = await secretsManager.getSecret(testSecretName);
  console.log(JSON.stringify(createdSecret));
}

A k6 script that will create a secret in AWS secrets manager

deleteSecret

Mon, 21 Sep 2026 15:16:28 +0000

deleteSecret

SecretsManagerClient.deleteSecret deletes a secret from AWS’ secrets manager.

Parameters

Parameter	Type	Description
secretID	string	The ARN or name of the secret to update.
options	{ recoveryWindow: 30, noRecovery: false }	Use options to control the deletion behavior. recoveryWindow defines how long a secret will remain “soft-deleted”, in days, before being hard-deleted. noRecovery set to true would hard-delete the secret immediately. Note that both options are exclusive.

Returns

Type	Description
`Promise<void>`	A promise that will be resolved when the secret is deleted

Example

import {
  AWSConfig,
  SecretsManagerClient,
} from 'https://jslib.k6.io/aws/0.14.0/secrets-manager.js';

const awsConfig = new AWSConfig({
  region: __ENV.AWS_REGION,
  accessKeyId: __ENV.AWS_ACCESS_KEY_ID,
  secretAccessKey: __ENV.AWS_SECRET_ACCESS_KEY,
});

const secretsManager = new SecretsManagerClient(awsConfig);
const testSecretName = 'jslib-test-secret';
const testSecretValue = 'jslib-test-value';

export default async function () {
  // Let's make sure our test secret is created
  const testSecret = await secretsManager.createSecret(
    testSecretName,
    testSecretValue,
    'this is a test secret, delete me.'
  );

  // Let's hard delete our test secret and verify it worked
  await secretsManager.deleteSecret(testSecretName, { noRecovery: true });
}

A k6 script that will delete a secret in AWS secrets manager

getSecret

Mon, 21 Sep 2026 15:16:28 +0000

getSecret

SecretsManagerClient.getSecret downloads a secret from AWS secrets manager.

Parameter	Type	Description
secretID	string	The ARN or name of the secret to retrieve.

Returns

Type	Description
Promise< Secret>	A Promise that fulfills with a Secret describing and holding the downloaded secret.

Example

import exec from 'k6/execution';

import {
  AWSConfig,
  SecretsManagerClient,
} from 'https://jslib.k6.io/aws/0.14.0/secrets-manager.js';

const awsConfig = new AWSConfig({
  region: __ENV.AWS_REGION,
  accessKeyId: __ENV.AWS_ACCESS_KEY_ID,
  secretAccessKey: __ENV.AWS_SECRET_ACCESS_KEY,
});

const secretsManager = new SecretsManagerClient(awsConfig);
const testSecretName = 'jslib-test-secret';

export default async function () {
  // List the secrets the AWS authentication configuration
  // gives us access to.
  const secrets = await secretsManager.listSecrets();
  if (secrets.filter((s) => s.name === testSecretName).length == 0) {
    exec.test.abort('test secret not found');
  }

  // Let's get our test secret's value and print it.
  const secret = await secretsManager.getSecret(testSecretName);
  console.log(JSON.stringify(secret));
}

A k6 script that will download a user’s secret from AWS secrets manager

listSecrets

Mon, 21 Sep 2026 15:16:28 +0000

listSecrets

S3Client.listSecrets lists the secrets the authenticated user has access to in the region set by the SecretsManagerClient instance’s configuration.

Returns

Type	Description
Promise<Array< Secret»	A Promise that fulfills with an array of Secret objects.

Example

import exec from 'k6/execution';

import {
  AWSConfig,
  SecretsManagerClient,
} from 'https://jslib.k6.io/aws/0.14.0/secrets-manager.js';

const awsConfig = new AWSConfig({
  region: __ENV.AWS_REGION,
  accessKeyId: __ENV.AWS_ACCESS_KEY_ID,
  secretAccessKey: __ENV.AWS_SECRET_ACCESS_KEY,
});

const secretsManager = new SecretsManagerClient(awsConfig);
const testSecretName = 'jslib-test-secret';

export default async function () {
  // List the secrets the AWS authentication configuration
  // gives us access to, and verify the test secret exists.
  const secrets = await secretsManager.listSecrets();
  if (secrets.filter((s) => s.name === testSecretName).length == 0) {
    exec.test.abort('test secret not found');
  }

  console.log(JSON.stringify(secrets));
}

A k6 script that will list a user’s secrets from AWS secrets manager

putSecretValue

Mon, 21 Sep 2026 15:16:28 +0000

putSecretValue

SecretsManagerClient.putSecretValue updates a secret’s value in AWS’ secrets manager.

Parameter	Type	Description
secretID	string	The ARN or name of the secret to update.
secretString	string	The text data to encrypt and store in this new version of the secret. We recommend you use a JSON structure of key/value pairs for your secret value.
versionID (optional)	string	Optional unique version identifier for the updated version of the secret. If no versionID is provided, an auto-generated UUID will be used instead.
tags (optional)	Array<{“key”: “value”},>	A list of tags to attach to the secret. Each tag is a key and value pair of strings in a JSON text string

Returns

Type	Description
Promise< Secret>	A Promise that fulfills with the updated Secret.

Example

import exec from 'k6/execution';

import {
  AWSConfig,
  SecretsManagerClient,
} from 'https://jslib.k6.io/aws/0.14.0/secrets-manager.js';

const awsConfig = new AWSConfig({
  region: __ENV.AWS_REGION,
  accessKeyId: __ENV.AWS_ACCESS_KEY_ID,
  secretAccessKey: __ENV.AWS_SECRET_ACCESS_KEY,
});

const secretsManager = new SecretsManagerClient(awsConfig);
const testSecretName = 'jslib-test-secret';
const testSecretValue = 'jslib-test-value';

export default async function () {
  // Let's make sure our test secret is created
  const testSecret = await secretsManager.createSecret(
    testSecretName,
    testSecretValue,
    'this is a test secret, delete me.'
  );

  // Now that we know the secret exist, let's update its value
  const newTestSecretValue = 'new-test-value';
  const u = await secretsManager.putSecretValue(testSecretName, newTestSecretValue);

  // Let's get its value back and verify it was indeed updated
  const updatedSecret = await secretsManager.getSecret(testSecretName);
  if (updatedSecret.secret !== newTestSecretValue) {
    exec.test.abort('unable to update test secret');
  }
}

A k6 script that will update a secret’s value in AWS secrets manager

Secret

Mon, 21 Sep 2026 15:16:28 +0000

Secret

Secret is returned by the SecretsManagerClient.* methods that query secrets. Namely, listSecrets, getSecret, createSecret, and putSecretValue returns either an instance or array of Secret objects. The Secret object describes an Amazon Secrets Manager secret.

Name	Type	Description
`Secret.name`	string	The friendly name of the secret. You can use forward slashes in the name to represent a path hierarchy.
`Secret.arn`	string	The Amazon Resource Name (ARN) of the secret.
`Secret.createdAt`	number	The date and time (timestamp) when a secret was created.
`Secret.lastAccessDate`	number	The last date that this secret was accessed. This value is truncated to midnight of the date and therefore shows only the date, not the time.
`Secret.lastChangedDate`	number	The last date and time that this secret was modified in any way.
`Secret.tags`	Array<{“key”: “value”}>	The list of user-defined tags associated with the secret.

Example

import exec from 'k6/execution';

import {
  AWSConfig,
  SecretsManagerClient,
} from 'https://jslib.k6.io/aws/0.14.0/secrets-manager.js';

const awsConfig = new AWSConfig({
  region: __ENV.AWS_REGION,
  accessKeyId: __ENV.AWS_ACCESS_KEY_ID,
  secretAccessKey: __ENV.AWS_SECRET_ACCESS_KEY,
});

const secretsManager = new SecretsManagerClient(awsConfig);
const testSecretName = 'jslib-test-secret';

export default async function () {
  // List the secrets the AWS authentication configuration
  // gives us access to.
  const secrets = await secretsManager.listSecrets();

  // If our test secret does not exist, abort the execution.
  if (secrets.filter((s) => s.name === testSecretName).length == 0) {
    exec.test.abort('test secret not found');
  }

  // Let's get it and print its content
  const downloadedSecret = await secretsManager.getSecret(testSecretName);
  console.log(downloadedSecret.secret);
}

A k6 script that will query the user’s secrets and print a test secret’s value