Policy: AWS > Secrets Manager > Secret > Tags > Template

The template is used to generate the keys and values for AWS Secrets Manager secret.

Tags not defined in Secret Tags Template will not be modified or deleted. Setting a tag value to undefined will result in the tag being deleted.

See Tags for more information.

Resource Types

This policy targets the following resource types:

AWS > Secrets Manager > Secret

Primary Policy

This policy is used with the following primary policy:

AWS > Secrets Manager > Secret > Tags

Controls

AWS > Secrets Manager > Secret > Tags

Policy Specification

Default template	`{%- if $.defaultTags.value \| length == 0 %} [] {%- elif $.defaultTags.value != undefined %}{{ $.defaultTags.value \| dump \| safe }}{%- else %}{% for item in $.defaultTags.value %}- {{ item }}{% endfor %}{% endif %}`
Default template input	`- \| { account { turbot { id } } } - \| { defaultTags: policyValue(uri:"tmod:@turbot/aws-secretsmanager#/policy/types/secretsManagerTagsTemplate" resourceId: "{{ $.account.turbot.id }}") { value } }`
Examples [YAML]	`foo: bar environment: prod` `- foo123: bar - environment: dev` `- cost-center: zz123 - delete-me: undefined`

Default template

{%- if $.defaultTags.value | length == 0 %} [] {%- elif $.defaultTags.value != undefined %}{{ $.defaultTags.value | dump | safe }}{%- else %}{% for item in $.defaultTags.value %}- {{ item }}{% endfor %}{% endif %}

Default template input

- |
  {
    account {
      turbot {
        id
      }
    }
  }
- |
  {
    defaultTags: policyValue(uri:"tmod:@turbot/aws-secretsmanager#/policy/types/secretsManagerTagsTemplate" resourceId: "{{ $.account.turbot.id }}") {
      value
    }
  }

Examples [YAML]

foo: bar
environment: prod

- foo123: bar
- environment: dev

- cost-center: zz123
- delete-me: undefined

In Your Workspace

Policy Settings by Type report

Developers

Category URI

tmod:@turbot/turbot#/control/categories/resourceTags

Policy Type URI

tmod:@turbot/aws-secretsmanager#/policy/types/secretTagsTemplate

GraphQL

query policyType(id: "tmod:@turbot/aws-secretsmanager#/policy/types/secretTagsTemplate") { … }

query policySettings(filter: "policyTypeId:'tmod:@turbot/aws-secretsmanager#/policy/types/secretTagsTemplate'") { … }

query policyValues(filter: "policyTypeId:'tmod:@turbot/aws-secretsmanager#/policy/types/secretTagsTemplate'") { … }

CLI

Get Policy Type

turbot graphql policy-type --id "tmod:@turbot/aws-secretsmanager#/policy/types/secretTagsTemplate"

Get Policy Settings

turbot graphql policy-settings --filter "policyTypeId:tmod:@turbot/aws-secretsmanager#/policy/types/secretTagsTemplate"