Skip to content

Create an Amazon Secrets Manager machine

Create an Amazon Secrets Manager machine so Certificate Manager - SaaS can store certificates as secrets in one Amazon Web Services (AWS) account and region, and discover the certificates already stored there. Each provisioned certificate and its private key are stored together in one secret.

Before you begin

  • The System Administrator, PKI Administrator, or Resource Owner role. If you have the Resource Owner role, you must own or belong to at least one team.
  • The Access Key ID and Secret Access Key of an AWS Identity and Access Management (IAM) user in the account that holds your secrets.
  • The AWS region where your secrets are stored.
  • An IAM policy attached to that user that grants at least these permissions:
    • secretsmanager:ListSecrets
    • secretsmanager:GetSecretValue
    • secretsmanager:DescribeSecret
    • secretsmanager:CreateSecret
    • secretsmanager:PutSecretValue
    • secretsmanager:TagResource
  • (Optional) If you want new secrets encrypted with a customer-managed Key Management Service (KMS) key instead of the AWS-managed key, the ID of that key and the kms:Decrypt and kms:GenerateDataKey permissions on it.

Note

Certificate Manager - SaaS never deletes secrets, so it doesn't need the secretsmanager:DeleteSecret permission.

To create an Amazon Secrets Manager machine

  1. Sign in to Certificate Manager - SaaS.
  2. Click Installations > Machines.
  3. Click New, and then select Amazon Secrets Manager.
  4. On the Properties step, in Name, enter a name for the machine.
  5. For Owning Team, choose the team that owns the machine. System Administrators and PKI Administrators can choose any team. Resource Owners can choose only a team they own or belong to.
  6. For Authentication Method, keep IAM User Access Keys. It's the only method available.

  7. For AWS Region, choose the region that holds your secrets. Regions are listed by location and region code, for example US East (N. Virginia) / us-east-1. The list includes the AWS GovCloud (US) and China regions.

    Important

    A machine connects to one region only. To manage secrets in more than one region, create a machine for each region.

  8. In Access Key ID and Secret Access Key, enter the access key pair of the IAM user.

    Note

    Certificate Manager - SaaS encrypts the credentials you enter and doesn't display them again. On the machine's Properties tab, they appear masked. To keep a stored credential when you edit the machine, leave its masked value unchanged. Keep your own secure record of the credentials in case you need them again.

  9. (Optional) In KMS Key ID, enter the ID of the customer-managed KMS key that encrypts new secrets. If you leave it empty, AWS encrypts new secrets with the AWS-managed key for Amazon Secrets Manager. The key applies only when Certificate Manager - SaaS creates a secret. A renewed secret keeps the key it already has.

  10. (Optional) In Secret Name Prefix, enter a prefix of up to 256 characters to add to the name of every secret this machine creates. For example, with the prefix venafi/, a certificate that you provision with the secret name example-com is stored as venafi/example-com. Discovery doesn't use the prefix, so it doesn't limit which secrets discovery finds.

  11. Click Test Access. After the connection succeeds, click Continue. The Discovery step opens.

    Note

    A successful test confirms that AWS accepts the access keys and that the IAM user has the secretsmanager:ListSecrets permission. It doesn't check the permissions needed to create or update secrets, or to use a KMS key. Problems with those permissions first appear when you provision a certificate.

  12. (Optional) In Tag Key, replace the default, venafi:managed, with the tag key that a secret must carry to be discovered. Certificate Manager - SaaS applies venafi:managed to every secret it creates.

  13. (Optional) In Tag Value, replace the default, true, with the value that the tag key must have.

    If you clear both Tag Key and Tag Value, discovery examines every secret in the region.

  14. (Optional) To skip certificates that have already expired, enable Exclude Expired Certificates.

  15. (Optional) To also examine secrets that are scheduled for deletion in Amazon Secrets Manager, enable Include Secrets Scheduled for Deletion.

    Note

    Discovery reads secrets that hold a certificate in JSON, Kubernetes, or Privacy-Enhanced Mail (PEM) text, or in a PKCS#12 file without a password. It skips, and doesn't fail on, secrets it can't read or interpret, such as secrets the IAM user can't decrypt, secrets whose value isn't a certificate, and password-protected PKCS#12 secrets.

  16. (Optional) To discover certificates on a schedule, enable Schedule. For Repeat every, choose Day, Week, or Month, and then in At, enter the time. For Week, select the days of the week. For Month, enter the days in Day of month. Times are in Coordinated Universal Time (UTC).

  17. Click Continue. The Provisioning step opens.

  18. (Optional) To provision certificates on a schedule, enable Schedule. For Repeat every, choose Day, Week, or Month, and then in At, enter the time. For Week, select the days of the week. For Month, enter the days in Day of month. Times are in Coordinated Universal Time (UTC).

    Scheduled provisioning pushes only certificates that are queued for deployment, such as renewed certificates, so renewals install during the window you choose.

  19. Click Finish.

What's next?

After you create the machine, provision a certificate to it. You can also run discovery on the machine at any time to track the certificates stored in your secrets.