---
schema_version: "1"
id: e4d6a0e92d7d969251cdcc277008f8d7a1de60e833ad85f9ba1c1a6de1d0637f
title: Amazon Secrets Manager Properties Provider 1.1 Reference
collection: mulesoft
version: current
locale: en-us
portal_url: https://docs.salesforce.com/mulesoft/current/en-us/amazon-secrets-manager-properties-provider-connector/1.1/amazon-secrets-manager-properties-provider-reference.md
canonical_url: https://docs.mulesoft.com/amazon-secrets-manager-properties-provider-connector/1.1/amazon-secrets-manager-properties-provider-reference
source_site: docs.mulesoft.com
content_type: documentation
content_hash: aa5ad8c8ec2970eaadbbe68547c45ddedf349a8ad42fe8cb2411588fac46d486
description: MuleSoft Documentation Site
release: "1.1"
latest: false
---
---
product: Amazon Secrets Manager Properties Provider
version: 1.1
---

# Amazon Secrets Manager Properties Provider 1.1 Reference

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

Amazon Secrets Manager Properties Provider is a configuration that enables you to retrieve your
secrets from Amazon Secrets Manager cloud service before your Mule app runs.

## Configuration

Default Configuration for Amazon Secrets Manager Properties Provider.

<table><colgroup><col> <col> <col> <col> <col></colgroup><thead><tr><th>Name</th><th>Type</th><th>Description</th><th>Default Value</th><th>Required</th></tr></thead><tbody><tr><td><p><strong>Name</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>Name for this configuration. Connectors reference the configuration with this name.</p></div></div></td><td><div></div></td><td><div><div><p>x</p></div></div></td></tr><tr><td><p><strong>Expiration Policy</strong></p></td><td><div><div><p><a href="#ExpirationPolicy">Expiration Policy</a></p></div></div></td><td><div><div><p>Configures the minimum amount of time that a dynamic configuration instance can remain idle before Mule considers it eligible for expiration. This does not mean that the instance expires at the exact moment that it becomes eligible. Mule purges the instances as appropriate.</p></div></div></td><td><div></div></td><td><div><div><p>x</p></div></div></td></tr><tr><td><p><strong>AWS Secrets Manager Region</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>AWS Secrets Manager region, for example, <code>us-east-2</code>.</p></div></div></td><td><div></div></td><td><div><div><p>x</p></div></div></td></tr><tr><td><p><strong>AWS Access Key</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>AWS access key ID.</p></div></div></td><td><div></div></td><td><div></div></td></tr><tr><td><p><strong>AWS Secret Key a</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>AWS secret key ID.</p></div></div></td><td><div></div></td><td><div></div></td></tr><tr><td><p><strong>Role ARN</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>Uniquely identifies a role to gain cross-account access.</p></div></div></td><td><div></div></td><td><div></div></td></tr><tr><td><p><strong>External ID</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>The External ID is used to prevent the confused deputy problem when assuming a role in another account.</p></div></div></td><td><div></div></td><td><div></div></td></tr></tbody></table>

## Types

### Expiration Policy

<table><colgroup><col> <col> <col> <col> <col></colgroup><thead><tr><th>Field</th><th>Type</th><th>Description</th><th>Default Value</th><th>Required</th></tr></thead><tbody><tr><td><p>Max Idle Time</p></td><td><div><div><p>Number</p></div></div></td><td><p>Configures the maximum amount of time that a dynamic configuration instance can remain idle before Mule considers it eligible for expiration.</p></td><td></td><td></td></tr><tr><td><p>Time Unit</p></td><td><div><div><p>Enumeration, one of:</p></div><div><ul><li><p>NANOSECONDS</p></li><li><p>MICROSECONDS</p></li><li><p>MILLISECONDS</p></li><li><p>SECONDS</p></li><li><p>MINUTES</p></li><li><p>HOURS</p></li><li><p>DAYS</p></li></ul></div></div></td><td><p>Time unit for the <strong>Max Idle Time</strong> field.</p></td><td></td><td></td></tr></tbody></table>

## Limitations

Amazon Secrets Manager Properties Provider doesn’t support the use of property files for the
configuration of the properties provider.

## Environment Variables

If you do not provide the **AWS Access Key**, **AWS Secret Key**, or **AWS Secrets Manager Region**
values in the configuration, Amazon Secrets Manager Properties Provider uses the
[default credentials provider chain - AWS SDK for Java 2.x](https://docs.aws.amazon.com/sdk-for-java/latest/developer-guide/credentials-chain.html)
to resolve credentials and the region from the runtime environment. This capability enables you to
avoid hardcoding AWS credentials in the Mule app configuration.

Use the following environment variables to configure the behavior of Amazon Secrets Manager
Properties Provider from the environment instead of specifying parameters in the Mule app
configuration:

- `AWS_ACCESS_KEY_ID`

- `AWS_SECRET_ACCESS_KEY`

- `AWS_SESSION_TOKEN` (required only when using temporary credentials)

- `AWS_REGION`

These variables are stored in secure configuration files with the values encrypted. During
execution, the runtime decrypts these values and they remain in memory in their decrypted state. For
more information, refer to [Protecting App Property Values](https://docs.mulesoft.com/cloudhub-2/ch2-protect-app-props).

Alternatively, you can set the equivalent Java system properties: `aws.accessKeyId`,
`aws.secretAccessKey`, `aws.sessionToken`, and `aws.region`. For the full list of credential sources
and the order in which they are evaluated, refer to the
[default credentials provider chain - AWS SDK for Java 2.x](https://docs.aws.amazon.com/sdk-for-java/latest/developer-guide/credentials-chain.html).

### Authenticate Through Environment Variables

To authenticate to Amazon Secrets Manager using environment variables, set the following environment
variables:

- `AWS_ACCESS_KEY_ID`

- `AWS_SECRET_ACCESS_KEY`

- `AWS_REGION`

Refer to [Setting Environment Variables](https://docs.mulesoft.com/mule-runtime/latest/setting-environment-variables)
for details.

If you do not set the **AWS Access Key**, **AWS Secret Key**, or **AWS Secrets Manager Region**
attributes in the configuration, the properties provider uses the values from the environment
variables.

In the XML configuration, you can omit the credential attributes when you rely on environment
variables:

```xml
<!-- Configuration using environment variables for AWS credentials and region -->
<aws-secrets-manager-properties-override:config name="AWS_Secrets_Manager_Properties_Override_Config" doc:name="AWS Secrets Manager Properties Override Config">
    <aws-secrets-manager-properties-override:basic-connection />
</aws-secrets-manager-properties-override:config>
```

If the properties provider cannot resolve credentials or the region from the configuration,
environment variables, or any other source in the default credentials provider chain, the Mule app
fails to start.

## See Also

- [Introduction to Anypoint Connectors](https://docs.mulesoft.com/connectors/introduction/introduction-to-anypoint-connectors)

- [Salesforce Help](https://help.salesforce.com)