Skip to content

Create a new Amazon Secrets Manager machine

Creating a new machine is the initial step in enabling Certificate Manager - SaaS to connect directly to application keystores for certificate management. Once you have created machines, you can move on to provisioning certificates to those machines.

An Amazon Secrets Manager machine connects to a single AWS account and region. Certificate Manager - SaaS stores each provisioned certificate and its private key as a secret in that account, and can also discover certificates that are already stored there.

Before you begin

  • The Access Key ID and Secret Access Key of an AWS IAM user in the account that holds your secrets.
  • The AWS region where your secrets are stored.
  • An IAM policy attached to that user granting, at minimum, the following permissions:
    • secretsmanager:ListSecrets
    • secretsmanager:GetSecretValue
    • secretsmanager:DescribeSecret
    • secretsmanager:CreateSecret
    • secretsmanager:PutSecretValue
    • secretsmanager:TagResource
  • (Optional) If you want new secrets encrypted with a customer-managed KMS key instead of the AWS-managed key, the ID of that key, plus the kms:Decrypt and kms:GenerateDataKey permissions on it.

Note

Certificate Manager - SaaS never deletes secrets, so secretsmanager:DeleteSecret is not required.

  1. From the Authentication Method drop-down, select IAM User Access Keys.

    Note

    IAM user access keys are currently the only supported authentication method.

  2. From the AWS Region drop-down, select the region that holds your secrets. Regions are listed by location and region code, for example US East (N. Virginia) / us-east-1. AWS GovCloud (US) and China regions are included in the list.

    Important

    A machine connects to one region only. To manage secrets in more than one region, create a separate machine for each region.

  3. Enter the Access Key ID of the IAM user that Certificate Manager - SaaS uses to authenticate.

  4. Enter the Secret Access Key paired with that Access Key ID.

    Warning

    Remember to store your username and password securely when creating a new machine. For security reasons, you will not be able to modify the fields under the "Access" tab without these credentials. This ensures that only authorized individuals can modify these fields.

  5. (Optional) In the KMS Key ID field, enter the customer-managed KMS key used to encrypt new secrets. If you leave this field empty, AWS encrypts new secrets with the AWS-managed key for Amazon Secrets Manager.

  6. (Optional) In the Secret Name Prefix field, enter a prefix of up to 256 characters. The prefix is prepended to the name of every secret this machine creates, and discovery returns only secrets whose names begin with it. For example, with the prefix venafi/, a certificate provisioned with the secret name example-com is stored as venafi/example-com.

  7. Click Test Access, then click Continue. Note that Continue is only enabled if the Test Access is successful.

    Note

    Test Access confirms that your credentials are valid and that they have the secretsmanager:ListSecrets permission. It does not verify the permissions needed to create or update secrets, or to use a KMS key. Problems with those permissions first appear when you provision a certificate.

Discovery options for Amazon Secrets Manager

When you configure the discovery schedule for this machine, the following options control which secrets Certificate Manager - SaaS examines. See Create a new machine for the rest of the discovery settings.

  1. In the Tag Key field, enter the tag key that discovered secrets must carry. The default is venafi:managed, which is the tag Certificate Manager - SaaS applies to every secret it creates.

  2. In the Tag Value field, enter the value that the tag key must have. The default is true.

  3. Enable Exclude Expired Certificates to omit certificates that have already expired from the discovery results.

  4. Enable Include Secrets Scheduled for Deletion to also examine secrets that are scheduled for deletion in Amazon Secrets Manager.

Note

Discovery skips, and does not fail on, secrets it cannot read or interpret — for example, secrets the IAM user cannot decrypt, secrets whose value is not a certificate, and password-protected PKCS#12 secrets. These secrets are recorded in the discovery log.

What's next?

Refer back to Create a new machine to finish setting up your new machine by configuring Discovery and Provisioning scheduling.

For existing machines: