Repository navigation
feat: add Secrets Manager service with all 23 operations - #8
Merged
Merged
Conversation
Implement full AWS Secrets Manager support for RustStack using Smithy-based codegen for model types and the same awsJson1.1 protocol infrastructure as SSM. Three new crates: - ruststack-secretsmanager-model: auto-generated from Smithy model (23 operations, 4 enums, 11 shared structs) - ruststack-secretsmanager-http: awsJson1.1 protocol layer with secretsmanager.* target routing - ruststack-secretsmanager-core: business logic for all operations Phase 0 - Core CRUD (10 ops): CreateSecret, GetSecretValue, PutSecretValue, DescribeSecret, DeleteSecret, RestoreSecret, UpdateSecret, ListSecrets, ListSecretVersionIds, GetRandomPassword Phase 1 - Tags/Rotation/Batch (6 ops): TagResource, UntagResource, UpdateSecretVersionStage, RotateSecret, CancelRotateSecret, BatchGetSecretValue Phase 2 - Policies/Replication (7 ops): GetResourcePolicy, PutResourcePolicy, DeleteResourcePolicy, ValidateResourcePolicy, ReplicateSecretToRegions, RemoveRegionsFromReplication, StopReplicationToReplica Key features: - Version staging labels (AWSCURRENT/AWSPREVIOUS/AWSPENDING) with automatic promotion semantics - Scheduled deletion with 7-30 day recovery window - Rotation lifecycle (metadata + AWSPENDING version creation) - Secret resolution by name, full ARN, or partial ARN - ListSecrets filtering (name, description, tag-key, tag-value, etc.) - Random password generation with configurable constraints - Resource policy store/retrieve (not enforced) - Replication stubs (accept and succeed) Includes CI workflow, integration tests, and server gateway integration. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- Add missing validate_secret_value/validate_client_request_token in CreateSecret and UpdateSecret - Fix GetSecretValue to verify version_stage when both version_id and version_stage are provided - Fix CancelRotateSecret to only remove AWSPENDING label without disabling rotation_enabled - Reject DeleteSecret on already-pending-deletion secrets - Add pending-deletion checks to TagResource, UntagResource, PutResourcePolicy, DeleteResourcePolicy - Fix BatchGetSecretValue filter path to avoid DashMap deadlock by collecting names before nested lookups - Fix schedule_deletion to store future deletion date (now + window) - Remove dead empty_tag() function from filter.rs - Replace expect() calls in HTTP response code with fallbacks Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
The AWS SDK expects timestamps as f64 epoch seconds in awsJson1.1, not ISO 8601 strings. Add epoch_seconds serde helper module and annotate all DateTime fields in output and shared types. This fixes all 17 Rust SDK integration test failures where DescribeSecret, GetSecretValue, and other responses with timestamp fields caused deserialization errors. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
AWS awsJson1.1 protocol expects binary blobs as base64-encoded strings, not raw byte arrays. Add blob serde module (matching the KMS pattern) and annotate all secret_binary fields in input, output, and shared types. Fixes the last integration test failure (test_should_create_secret_binary). Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
ruststack-secretsmanager-model(Smithy codegen),ruststack-secretsmanager-http(awsJson1.1 protocol),ruststack-secretsmanager-core(business logic)secretsmanagerfeature flag, CI workflow, and comprehensive integration testsOperations implemented
Phase 0 - Core CRUD (10 ops): CreateSecret, GetSecretValue, PutSecretValue, DescribeSecret, DeleteSecret, RestoreSecret, UpdateSecret, ListSecrets, ListSecretVersionIds, GetRandomPassword
Phase 1 - Tags/Rotation/Batch (6 ops): TagResource, UntagResource, UpdateSecretVersionStage, RotateSecret, CancelRotateSecret, BatchGetSecretValue
Phase 2 - Policies/Replication (7 ops): GetResourcePolicy, PutResourcePolicy, DeleteResourcePolicy, ValidateResourcePolicy, ReplicateSecretToRegions, RemoveRegionsFromReplication, StopReplicationToReplica
Key features
Test plan
cargo test --all-features)cargo clippy --all-targets --all-features -- -D warnings)cargo +nightly fmt)secretsmanager-test.ymlcovers all operations via AWS CLIaws-sdk-secretsmanagercover CRUD, version staging, deletion/restore, tags, rotation, batch, policies🤖 Generated with Claude Code