Secrets Manager operations
Every Secrets Manager operation Overcast declares — 19 of 22 implemented — with status, behaviour notes and a link to the AWS API reference for each.
19 of 22 listed operations are implemented. Back to Secrets Manager.
Summary
| Category | ✅ Supported | ❌ Unsupported |
|---|---|---|
| Secret CRUD | 9 | |
| Rotation | 3 | |
| Tags | 2 | |
| Password | 1 | |
| Policy/Misc | 4 | 3 |
Endpoints
Secret CRUD
| Operation | Status | Notes | AWS Docs |
|---|---|---|---|
CreateSecret | ✅ Supported | String + binary, KMS key, tags, description | docs |
GetSecretValue | ✅ Supported | By name, ARN, version ID, or stage | docs |
DescribeSecret | ✅ Supported | Metadata, KMS key, tags, versions, rotation dates | docs |
PutSecretValue | ✅ Supported | Staging labels + ClientRequestToken | docs |
UpdateSecret | ✅ Supported | Description, KMS key + optional new value | docs |
ListSecrets | ✅ Supported | Sorted by name, KMS metadata, optional filters — Filter.Key validated against AWS’s enum | docs |
ListSecretVersionIds | ✅ Supported | All versions with staging labels | docs |
DeleteSecret | ✅ Supported | Immediate (ForceDelete) only | docs |
BatchGetSecretValue | ✅ Supported | Partial results on missing secrets; Filter.Key validated against AWS’s enum | docs |
Rotation
| Operation | Status | Notes | AWS Docs |
|---|---|---|---|
RotateSecret | ✅ Supported | Invokes the rotation Lambda, all four steps | docs |
CancelRotateSecret | ✅ Supported | Turns rotation off, keeps the config | docs |
UpdateSecretVersionStage | ✅ Supported | Moves staging labels between versions | docs |
Tags
| Operation | Status | Notes | AWS Docs |
|---|---|---|---|
TagResource | ✅ Supported | Merge/overwrite tags | docs |
UntagResource | ✅ Supported | Removes specified tag keys | docs |
Password
| Operation | Status | Notes | AWS Docs |
|---|---|---|---|
GetRandomPassword | ✅ Supported | Modeled length bounds, exclusions, RequireEachIncludedType | docs |
Policy/Misc
| Operation | Status | Notes | AWS Docs |
|---|---|---|---|
GetResourcePolicy | ✅ Supported | Stored policy; not evaluated (#496) | docs |
PutResourcePolicy | ✅ Supported | Validated + stored; not evaluated (#496) | docs |
DeleteResourcePolicy | ✅ Supported | Removes the stored policy | docs |
ValidateResourcePolicy | ✅ Supported | Syntax + schema checks, no evaluation | docs |
RestoreSecret | ❌ Unsupported | stub; returns 501 | docs |
ReplicateSecretToRegions | ❌ Unsupported | stub; returns 501 | docs |
RemoveRegionsFromReplication | ❌ Unsupported | stub; returns 501 | docs |
Related
- Secrets Manager — quick start, what works, and the differences from AWS
- All service pages