aws-secretsmanager-get-secrets GitHub Action

By default, parse-json-secrets is false, and the entire secret value is set as a single environment variable.

Set parse-json-secrets: true to create individual environment variables for every key-value pair within a JSON secret.

Naming Convention: When parsing JSON, the environment variable name is constructed as {SECRET_NAME}_{JSON_KEY_NAME}.

Warning: If your JSON uses case-sensitive keys that result in duplicate environment variable names (e.g., "name" and "Name"), the action will fail. In such cases, set parse-json-secrets: false and parse the JSON manually in a subsequent step.

- name: Get Secrets and Parse JSON
  uses: aws-actions/aws-secretsmanager-get-secrets@v3
  with:
    secret-ids: |
      test/secret
      ,secret2
    parse-json-secrets: true

Before using this action, you must configure AWS credentials and the AWS Region in your GitHub environment. It is recommended to use the configure-aws-credentials action to assume a role directly using a GitHub OIDC provider to use short-lived credentials.

The IAM role assumed by the action requires the following permissions:

• GetSecretValue on the target secrets.
• ListSecrets on all secrets.
• Decrypt on the KMS key (optional, only if secrets are encrypted with a customer-managed key).

Add a step to your workflow using aws-actions/aws-secretsmanager-get-secrets@v3. You can retrieve secrets by their name, ARN, or name prefix. You can also map secrets to specific environment variable names (aliases) or parse JSON secrets into individual environment variables.

- name: Step name
  uses: aws-actions/aws-secretsmanager-get-secrets@v3
  with:
    secret-ids: |
      secretId1
      ENV_VAR_NAME, secretId2
    name-transformation: (Optional) uppercase|lowercase|none
    parse-json-secrets: (Optional) true|false
    auto-select-family-attempt-timeout: (Optional) positive integer

By default, the action transforms secret names into environment variable names using only uppercase letters, numbers, and underscores, ensuring they do not start with a number. You can customize this behavior:

• uppercase (default): Converts letters to uppercase.
• lowercase: Converts letters to lowercase.
• none: Preserves the original case of the letters.

If a secret value is a valid JSON object, the action can automatically parse it and inject its keys as nested environment variables.

Behavior:

• The action recursively traverses the JSON object.
• Nested keys are appended to the parent environment variable name using underscores.
• Example: A secret named DATABASE containing {"host": "localhost"} will result in an environment variable DATABASE_HOST=localhost.

Note: Only JSON objects (not arrays or nulls) are treated as injectable secret maps.

The action converts AWS Secret names into valid GitHub Actions environment variables. By default, names are converted to UPPERCASE.

Rules for valid environment variable names:

• Must consist only of uppercase letters, digits, and underscores.
• Cannot begin with a number (if a secret name starts with a digit, an underscore is prepended).
• Invalid characters are replaced with underscores.

You can customize this behavior using a nameTransformation function (e.g., uppercase, lowercase, or none).

When retrieving secrets, you can provide an alias to ensure the resulting environment variable has a specific name. This is critical if multiple secrets would otherwise transform into the same environment variable name.

Format: ALIAS,SECRET_NAME_OR_ARN

Example: MY_APP_SECRET,prod/api/key will result in an environment variable named MY_APP_SECRET.

Constraints:

• The alias must be a valid environment variable name (uppercase, numbers, underscores).
• If you use an alias with a prefix search (e.g., ALIAS,prefix/*), the alias must be unique to the search result.

You can mix and match different ways to identify secrets in the secret-ids list.

- name: Get secrets by name and by ARN
  uses: aws-actions/aws-secretsmanager-get-secrets@v3
  with:
    secret-ids: |
      exampleSecretName
      arn:aws:secretsmanager:us-east-2:123456789012:secret:test1-a1b2c3
      0/test/secret
      /prod/example/secret
      SECRET_ALIAS_1,test/secret
      SECRET_ALIAS_2,arn:aws:secretsmanager:us-east-2:123456789012:secret:test2-a1b2c3
      ,secret2

Use an asterisk * to match all secrets starting with a specific string.

- name: Get Secret Names by Prefix
  uses: aws-actions/aws-secretsmanager-get-secrets@v3
  with:
    secret-ids: |
      beta*    # Retrieves all secrets that start with 'beta'

When parse-json-secrets is enabled, keys within the JSON become environment variables prefixed by the secret name.

- name: Get Secrets by Name and by ARN
  uses: aws-actions/aws-secretsmanager-get-secrets@v3
  with:
    secret-ids: |
      test/secret
      ,secret2
    parse-json-secrets: true