Modify an Amazon Secrets Manager secret - Amazon Secrets Manager
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Modify an Amazon Secrets Manager secret

You can modify the metadata of a secret after it is created, depending on who created the secret. For secrets created by other services, you might need to use the other service to update or rotate it.

To determine who manages a secret, you can review the secret name. Secrets managed by other services are prefixed with the ID of that service. Or, in the Amazon CLI, call describe-secret, and then review the field OwningService. For more information, see Amazon Secrets Manager secrets managed by other Amazon services.

For secrets you manage, you can modify the description, resource-based policy, the encryption key, and tags. You can also change the encrypted secret value; however, we recommend you use rotation to update secret values that contain credentials. Rotation updates both the secret in Secrets Manager and the credentials on the database or service. This keeps the secret automatically synchronized so when clients request a secret value, they always get a working set of credentials. For more information, see Rotate Amazon Secrets Manager secrets.

Secrets Manager generates a CloudTrail log entry when you modify a secret. For more information, see Log Amazon Secrets Manager events with Amazon CloudTrail.

To update a secret you manage (console)
  1. Open the Secrets Manager console at

  2. From the list of secrets, choose your secret.

  3. On the secret details page, do any of the following:

    Note that you can't change the name or ARN of a secret.

Amazon CLI

Example Update secret description

The following update-secret example updates the description of a secret.

aws secretsmanager update-secret \ --secret-id MyTestSecret \ --description "This is a new description for the secret."

Amazon SDK

We recommend you avoid calling PutSecretValue or UpdateSecret at a sustained rate of more than once every 10 minutes. When you call PutSecretValue or UpdateSecret to update the secret value, Secrets Manager creates a new version of the secret. Secrets Manager removes unlabeled versions when there are more than 100, but it does not remove versions created less than 24 hours ago. If you update the secret value more than once every 10 minutes, you create more versions than Secrets Manager removes, and you will reach the quota for secret versions.

To update a secret, use the following actions: UpdateSecret or ReplicateSecretToRegions. For more information, see Amazon SDKs.