---
schema_version: "1"
id: 1edcb7ce69b3b64602163ac8e0403fd39fc140af73af38ea843d02a5cd4734aa
title: Amazon Secrets Manager Properties Provider Examples
collection: mulesoft
version: current
locale: en-us
portal_url: https://docs.salesforce.com/mulesoft/current/en-us/amazon-secrets-manager-properties-provider-connector/1.1/amazon-secrets-manager-examples.md
canonical_url: https://docs.mulesoft.com/amazon-secrets-manager-properties-provider-connector/1.1/amazon-secrets-manager-examples
source_site: docs.mulesoft.com
content_type: documentation
content_hash: 2c158fef265301c13f781a07cba8cbf51e9b0c419a0f9b03343ce11c10904717
description: MuleSoft Documentation Site
release: "1.1"
latest: false
---
---
product: Amazon Secrets Manager Properties Provider
version: 1.1
---

# Amazon Secrets Manager Properties Provider Examples

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

The following examples enable you how to configure Amazon Secrets Manager Properties Provider to
retrieve your secrets from Amazon Secrets Manager cloud service

> [!NOTE] When using dynamic configurations (such as `#[]`), the configuration lifecycle differs
> significantly from static configurations (such as `${}`). For more information, see
> [Dynamic Configuration Lifecycle](https://docs.mulesoft.com/mule-sdk/latest/static-dynamic-configs#dynamic-configuration-lifecycle).

## Configure AWS Connection Types

Anypoint Connectors can use Amazon Secrets Manager Properties Provider in their configurations. The
following example illustrates how to configure the AWS connection type in the **AWS Secrets Manager
Properties Override Config** of Anypoint Studio:

1.  In Studio, navigate to the **Global Elements** tab.

2.  Click **Create**.

3.  In the **Choose Global Type** window, type `AWS Secrets Manager`.

4.  Select **AWS Secrets Manager Properties Override Config**.

5.  Click **OK**.

6.  In the **Global Element Properties** window, you can configure the following fields:

<table><colgroup><col> <col> <col> <col> <col></colgroup><thead><tr><th>Name</th><th>Type</th><th>Description</th><th>Default Value</th><th>Required</th></tr></thead><tbody><tr><td><p><strong>AWS Secrets Manager Region</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>AWS Secrets Manager region, for example, <code>us-east-2</code>.</p></div></div></td><td><div></div></td><td><div><div><p>x</p></div></div></td></tr><tr><td><p><strong>AWS Access Key</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>AWS access key ID.</p></div></div></td><td><div></div></td><td><div></div></td></tr><tr><td><p><strong>AWS Secret Key a</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>AWS secret key ID.</p></div></div></td><td><div></div></td><td><div></div></td></tr><tr><td><p><strong>Role ARN</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>Uniquely identifies a role to gain cross-account access.</p></div></div></td><td><div></div></td><td><div></div></td></tr><tr><td><p><strong>External ID</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>The External ID is used to prevent the confused deputy problem when assuming a role in another account.</p></div></div></td><td><div></div></td><td><div></div></td></tr></tbody></table>

![Example of Amazon Secrets Manager Properties Provider in Global Element Properties window of Anypoint Studio](/mulesoft/current/en-us/amazon-secrets-manager-properties-provider-connector/1.1/_images/amazon-secrets-manager-properties.png)

In the **Configuration XML** editor, the configuration looks like this:

```xml
  <aws-secrets-manager-properties-override:config name="AWS_Secrets_Manager_Properties_Override_Config" doc:name="AWS Secrets Manager Properties Override Config" doc:id="4507e2b4-3205-4400-b903-848dcba504a7" >
		<aws-secrets-manager-properties-override:basic-connection region="us-east-1" />
		<aws-secrets-manager-properties-override:role-connection roleARN="arn:aws:iam::480410955647:role/AmazonSSMRoleForAutomationAssumeQuickSetup" externalId="38cf7bd2-decf-4ac3-8cff-cbad32f29bg9" />
	</aws-secrets-manager-properties-override:config>
```

If you do not provide credentials, the default AWS connection follows the
[default credentials provider chain - AWS SDK for Java 2.x](https://docs.aws.amazon.com/sdk-for-java/latest/developer-guide/credentials-chain.html).
This chain enables you to supply AWS credentials and the region through runtime environment
variables (for example, `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, and `AWS_REGION`) instead of
hardcoding them in the Mule app configuration. For the list of supported environment variables and a
configuration example, see
[Environment Variables](https://docs.mulesoft.com/amazon-secrets-manager-properties-provider-connector/1.1/amazon-secrets-manager-properties-provider-reference#environment-variables).

## Configure AWS Secrets Manager Using a JSON String

The following example shows how to configure the Amazon Secrets Manager Properties Provider for
Amazon S3 Connector by using a JSON string where you create the secret manager keys.

Based on a JSON file that contains `accessKey` and `secretKey`:

aws secretsmanager create-secret --name aws-credentials --secret-string '{"accessKey":"ACCESSKEY",
"secretKey":"SECRET"}'

1.  In the **Amazon S3 Configuration** global element properties window, select **fx** to set
    expression values.

2.  Set **Access Key** to `${aws-secrets::aws-credentials}.accessKey`.

3.  Set **Secret Key** to `${aws-secrets::aws-credentials}.secretKey`.

![Example of Amazon Secrets Manager Properties Provider configuration for Amazon S3 Connector with JSON expression](/mulesoft/current/en-us/amazon-secrets-manager-properties-provider-connector/1.1/_images/aws-sm-json-1.png)

In the **Configuration XML** editor, the configuration looks like this:

```xml
<s3:config name="Amazon_S3_Configuration" doc:name="Amazon S3 Configuration">
		<s3:connection accessKey="#[${aws-secrets::aws-credentials}.accessKey]" secretKey="#[${aws-secrets::aws-credentials}.secretKey]" />
	</s3:config>
```

### Handle JSON Keys with Dots

If your JSON secret contains keys with dots in their names, DataWeave treats the dots as subtrees in
JSON. Make sure that configuration fields are set to `Expression mode` (fx button enabled) when
using these syntaxes.

For example, with this JSON structure, access the value using
`${aws-secrets::mySecretName}.'myProject.demo.accessKey'`.

{ "myProject.demo.accessKey": "XXXXXXXX", "myProject.demo.secretKey": "XXXXXXXX",
"myProject.demo.region": "us-east-1", "myProject.demo.roleArn":
"arn:aws:iam::XXXXXXXXXXX:role/AmazonDemoTestRole", "myProject.example.http.Port": "8081" }

For example, with this JSON structure, access the value using
`${aws-secrets::mySecretName}.myProject.demo.accessKey`.

{ "myProject": { "demo": { "accessKey": "XXXXXXXX", "secretKey": "XXXXXXXX", "region": "us-east-1",
"roleArn": "arn:aws:iam::XXXXXXXXXXX:role/AmazonDemoTestRole" } } }

#### Example: Using JSON Keys with Dots With IBM Connector Configuration

This example shows how to configure IBM MQ Connector using JSON keys with dots in their names:

```xml
<ibm-mq:config name="IBM_MQ_Config" doc:name="IBM MQ Config">
	<ibm-mq:connection username="#[${aws-secrets::mySecretName}.'myProject.example.user']" password="#[${aws-secrets::mySecretName}.'myProject.example.pass']">
		<ibm-mq:connection-mode>
			<ibm-mq:client host="localhost" queueManager="QM1" channel="dummyChannel"/>
		</ibm-mq:connection-mode>
	</ibm-mq:connection>
</ibm-mq:config>
```

## Configure AWS Secrets Manager as a String

The following example shows how to configure the secret manager keys as a string for Amazon S3
Connector.

Based on the following string:

aws secretsmanager create-secret --name accessKey --secret-string "ACCESSKEY" aws secretsmanager
create-secret --name secretKey --secret-string "SECRET"

In the **Amazon S3 Configuration** global element properties window:

1.  Set **Access Key** to `${aws-secrets::accessKey}`.

2.  Set **Secret Key** to `${aws-secrets::secretKey}`.

![Example of Amazon Secrets Manager Properties Provider configuration for Amazon S3 Connector with a string value](/mulesoft/current/en-us/amazon-secrets-manager-properties-provider-connector/1.1/_images/aws-sm-json-2.png)

In the **Configuration XML** editor, the configuration looks like this:

```xml
<s3:config name="Amazon_S3_Configuration" doc:name="Amazon S3 Configuration" >
		<s3:connection accessKey="${aws-secrets::accessKey}" secretKey="${aws-secrets::secretKey}" />
	</s3:config>
```

Avoid using the `$` special character in values stored in the secret manager. If you must use the
`$` character, use the variable in literal mode, which treats it as a string. After that, you can
convert the entire value to JSON and extract the required information.

## See Also

[Salesforce Help](https://help.salesforce.com)