> ## Documentation Index
> Fetch the complete documentation index at: https://infisical-test-ldap-connection.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# AWS Secrets Manager

> Learn how to sync secrets from Infisical to AWS Secrets Manager.

Prerequisites:

* Set up and add envars to [Infisical Cloud](https://app.infisical.com)
* Set up AWS and have/create an IAM user

<Steps>
  <Step title="Grant the IAM user permissions to access AWS Secrets Manager">
    Navigate to your IAM user permissions and add a permission policy to grant access to AWS Secrets Manager.

    ![integration IAM 1](https://mintlify.s3-us-west-1.amazonaws.com/infisical-test-ldap-connection/images/integrations/aws/integrations-aws-iam-1.png)
    ![integration IAM 2](https://mintlify.s3-us-west-1.amazonaws.com/infisical-test-ldap-connection/images/integrations/aws/integrations-aws-secret-manager-iam-2.png)
    ![integrations IAM 3](https://mintlify.s3-us-west-1.amazonaws.com/infisical-test-ldap-connection/images/integrations/aws/integrations-aws-secret-manager-iam-3.png)

    For better security, here's a custom policy containing the minimum permissions required by Infisical to sync secrets to AWS Secrets Manager for the IAM user that you can use:

    ```json
    {
      "Version": "2012-10-17",
      "Statement": [
        {
          "Sid": "AllowSecretsManagerAccess",
          "Effect": "Allow",
          "Action": [
            "secretsmanager:GetSecretValue",
            "secretsmanager:CreateSecret",
            "secretsmanager:UpdateSecret",
            "secretsmanager:TagResource", // if you need to add tags to secrets
            "kms:ListKeys", // if you need to specify the KMS key
            "kms:ListAliases" // if you need to specify the KMS key
          ],
          "Resource": "*"
        }
      ]
    }
    ```
  </Step>

  <Step title="Authorize Infisical for AWS Secrets Manager">
    Obtain a AWS access key ID and secret access key for your IAM user in IAM > Users > User > Security credentials > Access keys

    ![access key 1](https://mintlify.s3-us-west-1.amazonaws.com/infisical-test-ldap-connection/images/integrations/aws/integrations-aws-access-key-1.png)
    ![access key 2](https://mintlify.s3-us-west-1.amazonaws.com/infisical-test-ldap-connection/images/integrations/aws/integrations-aws-access-key-2.png)
    ![access key 3](https://mintlify.s3-us-west-1.amazonaws.com/infisical-test-ldap-connection/images/integrations/aws/integrations-aws-access-key-3.png)

    Navigate to your project's integrations tab in Infisical.

    ![integrations](https://mintlify.s3-us-west-1.amazonaws.com/infisical-test-ldap-connection/images/integrations.png)

    Press on the AWS Secrets Manager tile and input your AWS access key ID and secret access key from the previous step.

    ![integration auth](https://mintlify.s3-us-west-1.amazonaws.com/infisical-test-ldap-connection/images/integrations/aws/integrations-aws-secret-manager-auth.png)
  </Step>

  <Step title="Start integration">
    Select how you want to integration to work by specifying a number of parameters:

    <ParamField path="Project Environment" type="string" required>
      The environment in Infisical from which you want to sync secrets to AWS Secrets Manager.
    </ParamField>

    <ParamField path="Secrets Path" type="string" required>
      The path within the preselected environment form which you want to sync secrets to AWS Secrets Manager.
    </ParamField>

    <ParamField path="AWS Region" type="string" required>
      The region that you want to integrate with in AWS Secrets Manager.
    </ParamField>

    <ParamField path="AWS SM Secret Name" type="string" required>
      The secret name/path in AWS into which you want to sync the secrets from Infisical.
    </ParamField>

    ![integration create](https://mintlify.s3-us-west-1.amazonaws.com/infisical-test-ldap-connection/images/integrations/aws/integrations-aws-secret-manager-create.png)

    Optionally, you can add tags or specify the encryption key of all the secrets created via this integration:

    <ParamField path="Secret Tag" type="string" optional>
      The Key/Value of a tag that will be added to secrets in AWS. Please note that it is possible to add multiple tags via API.
    </ParamField>

    <ParamField path="Encryption Key" type="string" optional>
      The alias/ID of the AWS KMS key used for encryption. Please note that key should be enabled in order to work and the IAM user should have access to it.
    </ParamField>

    ![integration options](https://mintlify.s3-us-west-1.amazonaws.com/infisical-test-ldap-connection/images/integrations/aws/integrations-aws-secret-manager-options.png)

    Then, press `Create Integration` to start syncing secrets to AWS Secrets Manager.

    <Info>
      Infisical currently syncs environment variables to AWS Secrets Manager as
      key-value pairs under one secret. We're actively exploring ways to help users
      group environment variable key-pairs under multiple secrets for greater
      control.
    </Info>

    <Info>
      Please note that upon deleting secrets in Infisical, AWS Secrets Manager immediately makes the secrets inaccessible but only schedules them for deletion after at least 7 days.
    </Info>
  </Step>
</Steps>