# mulesoft Amazon Secrets Manager Properties Provider - Full Documentation

<!-- document id=0e0756201753266ea2777d254c3f40fc78449fecedb941cec67ac88022754c15 url=/mulesoft/current/en-us/amazon-secrets-manager-properties-provider-connector/1.0/index.md -->

---
product: Amazon Secrets Manager Properties Provider
version: 1.0
---

# Amazon Secrets Manager Properties Provider 1.0

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

Amazon Secrets Manager Properties Provider is a configuration that enables you to retrieve your
secrets from Amazon Secrets Manager cloud service before your Mule app runs.

For information about compatibility and fixed issues, refer to the Amazon Secrets Manager Properties
Provider Release Notes.

## Before You Begin

To use this properties provider, you must be familiar with:

- AWS Secrets Manager

- Anypoint Connectors

- Mule runtime engine (Mule)

- Elements and global elements in a Mule flow

- How to create a Mule app using Anypoint Studio

Before creating an app, you must have:

- Mule Enterprise Edition

- Credentials to access the AWS Secrets

- Anypoint Platform

- Anypoint Studio or Anypoint Code Builder

## Common Use Cases for the Properties Provider

With AWS Secrets Manager Properties Provider, you can:

- Configure values from AWS Secrets Manager for Mule applications.

- Retrieve secrets for SaaS applications as part of the source or operation.

- Specify the name of the secret to retrieve.

- Authenticate to AWS using the available options from the AWS SDK IAM, default provider chain, or
  Basic Authentication.

- Specify the AWS server or region to connect to the appropriate server for your business unit.

- Be notified about errors while connecting to AWS.

- Be notified about errors while retrieving secrets from AWS.

## See Also

- [Amazon Secrets Manager Properties Provider Examples](https://docs.mulesoft.com/amazon-secrets-manager-properties-provider-connector/1.0/amazon-secrets-manager-examples)

- [Introduction to Anypoint Connectors](https://docs.mulesoft.com/connectors/introduction/introduction-to-anypoint-connectors)

- [Use Exchange to Discover Connectors, Templates, and Examples](https://docs.mulesoft.com/connectors/introduction/intro-use-exchange)

- [Amazon Secrets Manager Properties Provider Reference](https://docs.mulesoft.com/amazon-secrets-manager-properties-provider-connector/1.0/amazon-secrets-manager-properties-provider-reference)

- [Salesforce Help](https://help.salesforce.com)

<!-- document id=0e341048849b0aecb2eec76a4eb4b1f4b1b86a9193127676e9fa75bba0ac409b url=/mulesoft/current/en-us/amazon-secrets-manager-properties-provider-connector/1.0/amazon-secrets-manager-properties-provider-reference.md -->

---
product: Amazon Secrets Manager Properties Provider
version: 1.0
---

# Amazon Secrets Manager Properties Provider 1.0 Reference

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

Amazon Secrets Manager Properties Provider is a configuration that enables you to retrieve your
secrets from Amazon Secrets Manager cloud service before your Mule app runs.

## Configuration

Default Configuration for Amazon Secrets Manager Properties Provider.

<table><colgroup><col> <col> <col> <col> <col></colgroup><thead><tr><th>Name</th><th>Type</th><th>Description</th><th>Default Value</th><th>Required</th></tr></thead><tbody><tr><td><p><strong>Name</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>Name for this configuration. Connectors reference the configuration with this name.</p></div></div></td><td><div></div></td><td><div><div><p>x</p></div></div></td></tr><tr><td><p><strong>Expiration Policy</strong></p></td><td><div><div><p><a href="#ExpirationPolicy">Expiration Policy</a></p></div></div></td><td><div><div><p>Configures the minimum amount of time that a dynamic configuration instance can remain idle before Mule considers it eligible for expiration. This does not mean that the instance expires at the exact moment that it becomes eligible. Mule purges the instances as appropriate.</p></div></div></td><td><div></div></td><td><div><div><p>x</p></div></div></td></tr><tr><td><p><strong>AWS Secrets Manager Region</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>AWS Secrets Manager region, for example, <code>us-east-2</code>.</p></div></div></td><td><div></div></td><td><div><div><p>x</p></div></div></td></tr><tr><td><p><strong>AWS Access Key</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>AWS access key ID.</p></div></div></td><td><div></div></td><td><div></div></td></tr><tr><td><p><strong>AWS Secret Key a</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>AWS secret key ID.</p></div></div></td><td><div></div></td><td><div></div></td></tr><tr><td><p><strong>Role ARN</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>Uniquely identifies a role to gain cross-account access.</p></div></div></td><td><div></div></td><td><div></div></td></tr></tbody></table>

## Types

### Expiration Policy

<table><colgroup><col> <col> <col> <col> <col></colgroup><thead><tr><th>Field</th><th>Type</th><th>Description</th><th>Default Value</th><th>Required</th></tr></thead><tbody><tr><td><p>Max Idle Time</p></td><td><div><div><p>Number</p></div></div></td><td><p>Configures the maximum amount of time that a dynamic configuration instance can remain idle before Mule considers it eligible for expiration.</p></td><td></td><td></td></tr><tr><td><p>Time Unit</p></td><td><div><div><p>Enumeration, one of:</p></div><div><ul><li><p>NANOSECONDS</p></li><li><p>MICROSECONDS</p></li><li><p>MILLISECONDS</p></li><li><p>SECONDS</p></li><li><p>MINUTES</p></li><li><p>HOURS</p></li><li><p>DAYS</p></li></ul></div></div></td><td><p>Time unit for the <strong>Max Idle Time</strong> field.</p></td><td></td><td></td></tr></tbody></table>

## Limitations

Amazon Secrets Manager Properties Provider doesn’t support the use of property files for the
configuration of the properties provider.

## Environment Variables

If you do not provide the **AWS Access Key**, **AWS Secret Key**, or **AWS Secrets Manager Region**
values in the configuration, Amazon Secrets Manager Properties Provider uses the
[default credentials provider chain - AWS SDK for Java 2.x](https://docs.aws.amazon.com/sdk-for-java/latest/developer-guide/credentials-chain.html)
to resolve credentials and the region from the runtime environment. This capability enables you to
avoid hardcoding AWS credentials in the Mule app configuration.

Use the following environment variables to configure the behavior of Amazon Secrets Manager
Properties Provider from the environment instead of specifying parameters in the Mule app
configuration:

- `AWS_ACCESS_KEY_ID`

- `AWS_SECRET_ACCESS_KEY`

- `AWS_SESSION_TOKEN` (required only when using temporary credentials)

- `AWS_REGION`

These variables are stored in secure configuration files with the values encrypted. During
execution, the runtime decrypts these values and they remain in memory in their decrypted state. For
more information, refer to [Protecting App Property Values](https://docs.mulesoft.com/cloudhub-2/ch2-protect-app-props).

Alternatively, you can set the equivalent Java system properties: `aws.accessKeyId`,
`aws.secretAccessKey`, `aws.sessionToken`, and `aws.region`. For the full list of credential sources
and the order in which they are evaluated, refer to the
[default credentials provider chain - AWS SDK for Java 2.x](https://docs.aws.amazon.com/sdk-for-java/latest/developer-guide/credentials-chain.html).

### Authenticate Through Environment Variables

To authenticate to Amazon Secrets Manager using environment variables, set the following environment
variables:

- `AWS_ACCESS_KEY_ID`

- `AWS_SECRET_ACCESS_KEY`

- `AWS_REGION`

Refer to [Setting Environment Variables](https://docs.mulesoft.com/mule-runtime/latest/setting-environment-variables)
for details.

If you do not set the **AWS Access Key**, **AWS Secret Key**, or **AWS Secrets Manager Region**
attributes in the configuration, the properties provider uses the values from the environment
variables.

In the XML configuration, you can omit the credential attributes when you rely on environment
variables:

```xml
<!-- Configuration using environment variables for AWS credentials and region -->
<aws-secrets-manager-properties-override:config name="AWS_Secrets_Manager_Properties_Override_Config" doc:name="AWS Secrets Manager Properties Override Config">
    <aws-secrets-manager-properties-override:basic-connection />
</aws-secrets-manager-properties-override:config>
```

If the properties provider cannot resolve credentials or the region from the configuration,
environment variables, or any other source in the default credentials provider chain, the Mule app
fails to start.

## See Also

- [Introduction to Anypoint Connectors](https://docs.mulesoft.com/connectors/introduction/introduction-to-anypoint-connectors)

- [Salesforce Help](https://help.salesforce.com)

<!-- document id=059b97f28255c411776b85017a77cf57a861da91da2e4f692fc46eb0157edab4 url=/mulesoft/current/en-us/amazon-secrets-manager-properties-provider-connector/1.1/index.md -->

---
product: Amazon Secrets Manager Properties Provider
version: 1.1
---

# Amazon Secrets Manager Properties Provider 1.1

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

Amazon Secrets Manager Properties Provider is a configuration that enables you to retrieve your
secrets from Amazon Secrets Manager cloud service before your Mule app runs.

For information about compatibility and fixed issues, refer to the Amazon Secrets Manager Properties
Provider Release Notes.

## Before You Begin

To use this properties provider, you must be familiar with:

- AWS Secrets Manager

- Anypoint Connectors

- Mule runtime engine (Mule)

- Elements and global elements in a Mule flow

- How to create a Mule app using Anypoint Studio

Before creating an app, you must have:

- Mule Enterprise Edition

- Credentials to access the AWS Secrets

- Anypoint Platform

- Anypoint Studio or Anypoint Code Builder

## Common Use Cases for the Properties Provider

With AWS Secrets Manager Properties Provider, you can:

- Configure values from AWS Secrets Manager for Mule applications.

- Retrieve secrets for SaaS applications as part of the source or operation.

- Specify the name of the secret to retrieve.

- Authenticate to AWS using the available options from the AWS SDK IAM, default provider chain, or
  Basic Authentication.

- Specify the AWS server or region to connect to the appropriate server for your business unit.

- Be notified about errors while connecting to AWS.

- Be notified about errors while retrieving secrets from AWS.

## See Also

- [Amazon Secrets Manager Properties Provider Examples](https://docs.mulesoft.com/amazon-secrets-manager-properties-provider-connector/1.1/amazon-secrets-manager-examples)

- [Introduction to Anypoint Connectors](https://docs.mulesoft.com/connectors/introduction/introduction-to-anypoint-connectors)

- [Use Exchange to Discover Connectors, Templates, and Examples](https://docs.mulesoft.com/connectors/introduction/intro-use-exchange)

- [Amazon Secrets Manager Properties Provider Reference](https://docs.mulesoft.com/amazon-secrets-manager-properties-provider-connector/1.1/amazon-secrets-manager-properties-provider-reference)

- [Salesforce Help](https://help.salesforce.com)

<!-- document id=e4d6a0e92d7d969251cdcc277008f8d7a1de60e833ad85f9ba1c1a6de1d0637f url=/mulesoft/current/en-us/amazon-secrets-manager-properties-provider-connector/1.1/amazon-secrets-manager-properties-provider-reference.md -->

---
product: Amazon Secrets Manager Properties Provider
version: 1.1
---

# Amazon Secrets Manager Properties Provider 1.1 Reference

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

Amazon Secrets Manager Properties Provider is a configuration that enables you to retrieve your
secrets from Amazon Secrets Manager cloud service before your Mule app runs.

## Configuration

Default Configuration for Amazon Secrets Manager Properties Provider.

<table><colgroup><col> <col> <col> <col> <col></colgroup><thead><tr><th>Name</th><th>Type</th><th>Description</th><th>Default Value</th><th>Required</th></tr></thead><tbody><tr><td><p><strong>Name</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>Name for this configuration. Connectors reference the configuration with this name.</p></div></div></td><td><div></div></td><td><div><div><p>x</p></div></div></td></tr><tr><td><p><strong>Expiration Policy</strong></p></td><td><div><div><p><a href="#ExpirationPolicy">Expiration Policy</a></p></div></div></td><td><div><div><p>Configures the minimum amount of time that a dynamic configuration instance can remain idle before Mule considers it eligible for expiration. This does not mean that the instance expires at the exact moment that it becomes eligible. Mule purges the instances as appropriate.</p></div></div></td><td><div></div></td><td><div><div><p>x</p></div></div></td></tr><tr><td><p><strong>AWS Secrets Manager Region</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>AWS Secrets Manager region, for example, <code>us-east-2</code>.</p></div></div></td><td><div></div></td><td><div><div><p>x</p></div></div></td></tr><tr><td><p><strong>AWS Access Key</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>AWS access key ID.</p></div></div></td><td><div></div></td><td><div></div></td></tr><tr><td><p><strong>AWS Secret Key a</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>AWS secret key ID.</p></div></div></td><td><div></div></td><td><div></div></td></tr><tr><td><p><strong>Role ARN</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>Uniquely identifies a role to gain cross-account access.</p></div></div></td><td><div></div></td><td><div></div></td></tr><tr><td><p><strong>External ID</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>The External ID is used to prevent the confused deputy problem when assuming a role in another account.</p></div></div></td><td><div></div></td><td><div></div></td></tr></tbody></table>

## Types

### Expiration Policy

<table><colgroup><col> <col> <col> <col> <col></colgroup><thead><tr><th>Field</th><th>Type</th><th>Description</th><th>Default Value</th><th>Required</th></tr></thead><tbody><tr><td><p>Max Idle Time</p></td><td><div><div><p>Number</p></div></div></td><td><p>Configures the maximum amount of time that a dynamic configuration instance can remain idle before Mule considers it eligible for expiration.</p></td><td></td><td></td></tr><tr><td><p>Time Unit</p></td><td><div><div><p>Enumeration, one of:</p></div><div><ul><li><p>NANOSECONDS</p></li><li><p>MICROSECONDS</p></li><li><p>MILLISECONDS</p></li><li><p>SECONDS</p></li><li><p>MINUTES</p></li><li><p>HOURS</p></li><li><p>DAYS</p></li></ul></div></div></td><td><p>Time unit for the <strong>Max Idle Time</strong> field.</p></td><td></td><td></td></tr></tbody></table>

## Limitations

Amazon Secrets Manager Properties Provider doesn’t support the use of property files for the
configuration of the properties provider.

## Environment Variables

If you do not provide the **AWS Access Key**, **AWS Secret Key**, or **AWS Secrets Manager Region**
values in the configuration, Amazon Secrets Manager Properties Provider uses the
[default credentials provider chain - AWS SDK for Java 2.x](https://docs.aws.amazon.com/sdk-for-java/latest/developer-guide/credentials-chain.html)
to resolve credentials and the region from the runtime environment. This capability enables you to
avoid hardcoding AWS credentials in the Mule app configuration.

Use the following environment variables to configure the behavior of Amazon Secrets Manager
Properties Provider from the environment instead of specifying parameters in the Mule app
configuration:

- `AWS_ACCESS_KEY_ID`

- `AWS_SECRET_ACCESS_KEY`

- `AWS_SESSION_TOKEN` (required only when using temporary credentials)

- `AWS_REGION`

These variables are stored in secure configuration files with the values encrypted. During
execution, the runtime decrypts these values and they remain in memory in their decrypted state. For
more information, refer to [Protecting App Property Values](https://docs.mulesoft.com/cloudhub-2/ch2-protect-app-props).

Alternatively, you can set the equivalent Java system properties: `aws.accessKeyId`,
`aws.secretAccessKey`, `aws.sessionToken`, and `aws.region`. For the full list of credential sources
and the order in which they are evaluated, refer to the
[default credentials provider chain - AWS SDK for Java 2.x](https://docs.aws.amazon.com/sdk-for-java/latest/developer-guide/credentials-chain.html).

### Authenticate Through Environment Variables

To authenticate to Amazon Secrets Manager using environment variables, set the following environment
variables:

- `AWS_ACCESS_KEY_ID`

- `AWS_SECRET_ACCESS_KEY`

- `AWS_REGION`

Refer to [Setting Environment Variables](https://docs.mulesoft.com/mule-runtime/latest/setting-environment-variables)
for details.

If you do not set the **AWS Access Key**, **AWS Secret Key**, or **AWS Secrets Manager Region**
attributes in the configuration, the properties provider uses the values from the environment
variables.

In the XML configuration, you can omit the credential attributes when you rely on environment
variables:

```xml
<!-- Configuration using environment variables for AWS credentials and region -->
<aws-secrets-manager-properties-override:config name="AWS_Secrets_Manager_Properties_Override_Config" doc:name="AWS Secrets Manager Properties Override Config">
    <aws-secrets-manager-properties-override:basic-connection />
</aws-secrets-manager-properties-override:config>
```

If the properties provider cannot resolve credentials or the region from the configuration,
environment variables, or any other source in the default credentials provider chain, the Mule app
fails to start.

## See Also

- [Introduction to Anypoint Connectors](https://docs.mulesoft.com/connectors/introduction/introduction-to-anypoint-connectors)

- [Salesforce Help](https://help.salesforce.com)

<!-- document id=81dcf2c378acf4787841314aa28b282753c71df35707c5f726473777cf6a61c1 url=/mulesoft/current/en-us/amazon-secrets-manager-properties-provider-connector/latest/index.md -->

---
product: Amazon Secrets Manager Properties Provider
version: 1.2
is-latest-version: true
---

# Amazon Secrets Manager Properties Provider 1.2

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

Amazon Secrets Manager Properties Provider is a configuration that enables you to retrieve your
secrets from Amazon Secrets Manager cloud service before your Mule app runs.

For information about compatibility and fixed issues, refer to the Amazon Secrets Manager Properties
Provider Release Notes.

## Before You Begin

To use this properties provider, you must be familiar with:

- AWS Secrets Manager

- Anypoint Connectors

- Mule runtime engine (Mule)

- Elements and global elements in a Mule flow

- How to create a Mule app using Anypoint Studio

Before creating an app, you must have:

- Mule Enterprise Edition

- Credentials to access the AWS Secrets

- Anypoint Platform

- Anypoint Studio or Anypoint Code Builder

## Common Use Cases for the Properties Provider

With AWS Secrets Manager Properties Provider, you can:

- Configure values from AWS Secrets Manager for Mule applications.

- Retrieve secrets for SaaS applications as part of the source or operation.

- Specify the name of the secret to retrieve.

- Authenticate to AWS using the available options from the AWS SDK IAM, default provider chain, or
  Basic Authentication.

- Specify the AWS server or region to connect to the appropriate server for your business unit.

- Route AWS Secrets Manager and AWS STS calls through custom endpoints, such as an AWS VPC interface
  endpoint (AWS PrivateLink) or a local testing service such as LocalStack.

- Be notified about errors while connecting to AWS.

- Be notified about errors while retrieving secrets from AWS.

## See Also

- [Amazon Secrets Manager Properties Provider Examples](https://docs.mulesoft.com/amazon-secrets-manager-properties-provider-connector/latest/amazon-secrets-manager-examples)

- [Introduction to Anypoint Connectors](https://docs.mulesoft.com/connectors/introduction/introduction-to-anypoint-connectors)

- [Use Exchange to Discover Connectors, Templates, and Examples](https://docs.mulesoft.com/connectors/introduction/intro-use-exchange)

- [Amazon Secrets Manager Properties Provider Reference](https://docs.mulesoft.com/amazon-secrets-manager-properties-provider-connector/latest/amazon-secrets-manager-properties-provider-reference)

- [Salesforce Help](https://help.salesforce.com)

<!-- document id=a6f5d9cff8075e8a0050a13fbd13e6accdc338f24cff59b730d62339d9999503 url=/mulesoft/current/en-us/amazon-secrets-manager-properties-provider-connector/latest/amazon-secrets-manager-properties-provider-reference.md -->

---
product: Amazon Secrets Manager Properties Provider
version: 1.2
is-latest-version: true
---

# Amazon Secrets Manager Properties Provider 1.2 Reference

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

Amazon Secrets Manager Properties Provider is a configuration that enables you to retrieve your
secrets from Amazon Secrets Manager cloud service before your Mule app runs.

## Configuration

Default Configuration for Amazon Secrets Manager Properties Provider.

<table><colgroup><col> <col> <col> <col> <col></colgroup><thead><tr><th>Name</th><th>Type</th><th>Description</th><th>Default Value</th><th>Required</th></tr></thead><tbody><tr><td><p><strong>Name</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>Name for this configuration. Connectors reference the configuration with this name.</p></div></div></td><td><div></div></td><td><div><div><p>x</p></div></div></td></tr><tr><td><p><strong>Expiration Policy</strong></p></td><td><div><div><p><a href="#ExpirationPolicy">Expiration Policy</a></p></div></div></td><td><div><div><p>Configures the minimum amount of time that a dynamic configuration instance can remain idle before Mule considers it eligible for expiration. This does not mean that the instance expires at the exact moment that it becomes eligible. Mule purges the instances as appropriate.</p></div></div></td><td><div></div></td><td><div><div><p>x</p></div></div></td></tr><tr><td><p><strong>AWS Secrets Manager Region</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>AWS Secrets Manager region, for example, <code>us-east-2</code>.</p></div></div></td><td><div></div></td><td><div><div><p>x</p></div></div></td></tr><tr><td><p><strong>AWS Access Key</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>AWS access key ID.</p></div></div></td><td><div></div></td><td><div></div></td></tr><tr><td><p><strong>AWS Secret Key a</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>AWS secret key ID.</p></div></div></td><td><div></div></td><td><div></div></td></tr><tr><td><p><strong>Custom Endpoint URL</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>Custom endpoint URL that overrides the default regional AWS Secrets Manager endpoint. Use this field to route Secrets Manager calls through an AWS VPC interface endpoint (AWS PrivateLink) or to a local testing service such as LocalStack, for example, <code>http://localhost:4566</code>. When unset, the connector uses the default regional AWS endpoint.</p></div></div></td><td><div></div></td><td><div></div></td></tr><tr><td><p><strong>Role ARN</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>Uniquely identifies a role to gain cross-account access.</p></div></div></td><td><div></div></td><td><div></div></td></tr><tr><td><p><strong>External ID</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>The External ID is used to prevent the confused deputy problem when assuming a role in another account.</p></div></div></td><td><div></div></td><td><div></div></td></tr><tr><td><p><strong>STS Endpoint URL</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>Custom endpoint URL that overrides the default regional AWS STS endpoint used when assuming a role. Configure this field independently of <strong>Custom Endpoint URL</strong> to route AWS STS calls through a separate VPC interface endpoint. When unset, the connector uses the default regional AWS STS endpoint.</p></div></div></td><td><div></div></td><td><div></div></td></tr></tbody></table>

## Types

### Expiration Policy

<table><colgroup><col> <col> <col> <col> <col></colgroup><thead><tr><th>Field</th><th>Type</th><th>Description</th><th>Default Value</th><th>Required</th></tr></thead><tbody><tr><td><p>Max Idle Time</p></td><td><div><div><p>Number</p></div></div></td><td><p>Configures the maximum amount of time that a dynamic configuration instance can remain idle before Mule considers it eligible for expiration.</p></td><td></td><td></td></tr><tr><td><p>Time Unit</p></td><td><div><div><p>Enumeration, one of:</p></div><div><ul><li><p>NANOSECONDS</p></li><li><p>MICROSECONDS</p></li><li><p>MILLISECONDS</p></li><li><p>SECONDS</p></li><li><p>MINUTES</p></li><li><p>HOURS</p></li><li><p>DAYS</p></li></ul></div></div></td><td><p>Time unit for the <strong>Max Idle Time</strong> field.</p></td><td></td><td></td></tr></tbody></table>

## Limitations

- Amazon Secrets Manager Properties Provider doesn’t support the use of property files for the
  configuration of the properties provider.

- The **Custom Endpoint URL** value applies to all secrets retrieved by a given configuration. To
  retrieve secrets from different endpoints, configure multiple `config` elements with distinct
  names.

- Endpoint validation checks syntax only. Unreachable endpoints aren’t detected at deployment time
  and instead fail when a secret is first resolved.

## Environment Variables

If you do not provide the **AWS Access Key**, **AWS Secret Key**, or **AWS Secrets Manager Region**
values in the configuration, Amazon Secrets Manager Properties Provider uses the
[default credentials provider chain - AWS SDK for Java 2.x](https://docs.aws.amazon.com/sdk-for-java/latest/developer-guide/credentials-chain.html)
to resolve credentials and the region from the runtime environment. This capability enables you to
avoid hardcoding AWS credentials in the Mule app configuration.

Use the following environment variables to configure the behavior of Amazon Secrets Manager
Properties Provider from the environment instead of specifying parameters in the Mule app
configuration:

- `AWS_ACCESS_KEY_ID`

- `AWS_SECRET_ACCESS_KEY`

- `AWS_SESSION_TOKEN` (required only when using temporary credentials)

- `AWS_REGION`

These variables are stored in secure configuration files with the values encrypted. During
execution, the runtime decrypts these values and they remain in memory in their decrypted state. For
more information, refer to [Protecting App Property Values](https://docs.mulesoft.com/cloudhub-2/ch2-protect-app-props).

Alternatively, you can set the equivalent Java system properties: `aws.accessKeyId`,
`aws.secretAccessKey`, `aws.sessionToken`, and `aws.region`. For the full list of credential sources
and the order in which they are evaluated, refer to the
[default credentials provider chain - AWS SDK for Java 2.x](https://docs.aws.amazon.com/sdk-for-java/latest/developer-guide/credentials-chain.html).

### Authenticate Through Environment Variables

To authenticate to Amazon Secrets Manager using environment variables, set the following environment
variables:

- `AWS_ACCESS_KEY_ID`

- `AWS_SECRET_ACCESS_KEY`

- `AWS_REGION`

Refer to [Setting Environment Variables](https://docs.mulesoft.com/mule-runtime/latest/setting-environment-variables)
for details.

If you do not set the **AWS Access Key**, **AWS Secret Key**, or **AWS Secrets Manager Region**
attributes in the configuration, the properties provider uses the values from the environment
variables.

In the XML configuration, you can omit the credential attributes when you rely on environment
variables:

```xml
<!-- Configuration using environment variables for AWS credentials and region -->
<aws-secrets-manager-properties-override:config name="AWS_Secrets_Manager_Properties_Override_Config" doc:name="AWS Secrets Manager Properties Override Config">
    <aws-secrets-manager-properties-override:basic-connection />
</aws-secrets-manager-properties-override:config>
```

If the properties provider cannot resolve credentials or the region from the configuration,
environment variables, or any other source in the default credentials provider chain, the Mule app
fails to start.

## See Also

- [Introduction to Anypoint Connectors](https://docs.mulesoft.com/connectors/introduction/introduction-to-anypoint-connectors)

- [Salesforce Help](https://help.salesforce.com)

<!-- document id=cf04d88dd4d8f6521052cf07f5988a6f0321b43cc937491d77964c3cd1e9ef69 url=/mulesoft/current/en-us/amazon-secrets-manager-properties-provider-connector/1.0/amazon-secrets-manager-examples.md -->

---
product: Amazon Secrets Manager Properties Provider
version: 1.0
---

# Amazon Secrets Manager Properties Provider Examples

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

The following examples enable you how to configure Amazon Secrets Manager Properties Provider to
retrieve your secrets from Amazon Secrets Manager cloud service

> [!NOTE] When using dynamic configurations (such as `#[]`), the configuration lifecycle differs
> significantly from static configurations (such as `${}`). For more information, see
> [Dynamic Configuration Lifecycle](https://docs.mulesoft.com/mule-sdk/latest/static-dynamic-configs#dynamic-configuration-lifecycle).

## Configure AWS Connection Types

Anypoint Connectors can use Amazon Secrets Manager Properties Provider in their configurations. The
following example illustrates how to configure the AWS connection type in the **AWS Secrets Manager
Properties Override Config** of Anypoint Studio:

1.  In Studio, navigate to the **Global Elements** tab.

2.  Click **Create**.

3.  In the **Choose Global Type** window, type `AWS Secrets Manager`.

4.  Select **AWS Secrets Manager Properties Override Config**.

5.  Click **OK**.

6.  In the **Global Element Properties** window, you can configure the following fields:

<table><colgroup><col> <col> <col> <col> <col></colgroup><thead><tr><th>Name</th><th>Type</th><th>Description</th><th>Default Value</th><th>Required</th></tr></thead><tbody><tr><td><p><strong>AWS Secrets Manager Region</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>AWS Secrets Manager region, for example, <code>us-east-2</code>.</p></div></div></td><td><div></div></td><td><div><div><p>x</p></div></div></td></tr><tr><td><p><strong>AWS Access Key</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>AWS access key ID.</p></div></div></td><td><div></div></td><td><div></div></td></tr><tr><td><p><strong>AWS Secret Key a</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>AWS secret key ID.</p></div></div></td><td><div></div></td><td><div></div></td></tr><tr><td><p><strong>Role ARN</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>Uniquely identifies a role to gain cross-account access.</p></div></div></td><td><div></div></td><td><div></div></td></tr></tbody></table>

![Example of Amazon Secrets Manager Properties Provider in Global Element Properties window of Anypoint Studio](/mulesoft/current/en-us/amazon-secrets-manager-properties-provider-connector/1.0/_images/amazon-secrets-manager-properties.png)

In the **Configuration XML** editor, the configuration looks like this:

```xml
<aws-secrets-manager-properties-override:config name="AWS_Secrets_Manager_Properties_Override_Config" doc:name="AWS Secrets Manager Properties Override Config" >
		<aws-secrets-manager-properties-override:basic-connection region="us-east-1" />
		<aws-secrets-manager-properties-override:role-connection roleARN="arn:aws:iam::480410955647:role/AmazonSSMRoleForAutomationAssumeQuickSetup" />
	</aws-secrets-manager-properties-override:config>
```

If you do not provide credentials, the default AWS connection follows the
[default credentials provider chain - AWS SDK for Java 2.x](https://docs.aws.amazon.com/sdk-for-java/latest/developer-guide/credentials-chain.html).
This chain enables you to supply AWS credentials and the region through runtime environment
variables (for example, `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, and `AWS_REGION`) instead of
hardcoding them in the Mule app configuration. For the list of supported environment variables and a
configuration example, see
[Environment Variables](https://docs.mulesoft.com/amazon-secrets-manager-properties-provider-connector/1.0/amazon-secrets-manager-properties-provider-reference#environment-variables).

## Configure AWS Secrets Manager Using a JSON String

The following example shows how to configure the Amazon Secrets Manager Properties Provider for
Amazon S3 Connector by using a JSON string where you create the secret manager keys.

Based on a JSON file that contains `accessKey` and `secretKey`:

aws secretsmanager create-secret --name aws-credentials --secret-string '{"accessKey":"ACCESSKEY",
"secretKey":"SECRET"}'

1.  In the **Amazon S3 Configuration** global element properties window, select **fx** to set
    expression values.

2.  Set **Access Key** to `${aws-secrets::aws-credentials}.accessKey`.

3.  Set **Secret Key** to `${aws-secrets::aws-credentials}.secretKey`.

![Example of Amazon Secrets Manager Properties Provider configuration for Amazon S3 Connector with JSON expression](/mulesoft/current/en-us/amazon-secrets-manager-properties-provider-connector/1.0/_images/aws-sm-json-1.png)

In the **Configuration XML** editor, the configuration looks like this:

```xml
<s3:config name="Amazon_S3_Configuration" doc:name="Amazon S3 Configuration">
		<s3:connection accessKey="#[${aws-secrets::aws-credentials}.accessKey]" secretKey="#[${aws-secrets::aws-credentials}.secretKey]" />
	</s3:config>
```

### Handle JSON Keys with Dots

If your JSON secret contains keys with dots in their names, DataWeave treats the dots as subtrees in
JSON. Make sure that configuration fields are set to `Expression mode` (fx button enabled) when
using these syntaxes.

For example, with this JSON structure, access the value using
`${aws-secrets::mySecretName}.'myProject.demo.accessKey'`.

{ "myProject.demo.accessKey": "XXXXXXXX", "myProject.demo.secretKey": "XXXXXXXX",
"myProject.demo.region": "us-east-1", "myProject.demo.roleArn":
"arn:aws:iam::XXXXXXXXXXX:role/AmazonDemoTestRole", "myProject.example.http.Port": "8081" }

For example, with this JSON structure, access the value using
`${aws-secrets::mySecretName}.myProject.demo.accessKey`.

{ "myProject": { "demo": { "accessKey": "XXXXXXXX", "secretKey": "XXXXXXXX", "region": "us-east-1",
"roleArn": "arn:aws:iam::XXXXXXXXXXX:role/AmazonDemoTestRole" } } }

#### Example: Using JSON Keys with Dots With IBM Connector Configuration

This example shows how to configure IBM MQ Connector using JSON keys with dots in their names:

```xml
<ibm-mq:config name="IBM_MQ_Config" doc:name="IBM MQ Config">
	<ibm-mq:connection username="#[${aws-secrets::mySecretName}.'myProject.example.user']" password="#[${aws-secrets::mySecretName}.'myProject.example.pass']">
		<ibm-mq:connection-mode>
			<ibm-mq:client host="localhost" queueManager="QM1" channel="dummyChannel"/>
		</ibm-mq:connection-mode>
	</ibm-mq:connection>
</ibm-mq:config>
```

## Configure AWS Secrets Manager as a String

The following example shows how to configure the secret manager keys as a string for Amazon S3
Connector.

Based on the following string:

aws secretsmanager create-secret --name accessKey --secret-string "ACCESSKEY" aws secretsmanager
create-secret --name secretKey --secret-string "SECRET"

In the **Amazon S3 Configuration** global element properties window:

1.  Set **Access Key** to `${aws-secrets::accessKey}`.

2.  Set **Secret Key** to `${aws-secrets::secretKey}`.

![Example of Amazon Secrets Manager Properties Provider configuration for Amazon S3 Connector with a string value](/mulesoft/current/en-us/amazon-secrets-manager-properties-provider-connector/1.0/_images/aws-sm-json-2.png)

In the **Configuration XML** editor, the configuration looks like this:

```xml
<s3:config name="Amazon_S3_Configuration" doc:name="Amazon S3 Configuration" >
		<s3:connection accessKey="${aws-secrets::accessKey}" secretKey="${aws-secrets::secretKey}" />
	</s3:config>
```

Avoid using the `$` special character in values stored in the secret manager. If you must use the
`$` character, use the variable in literal mode, which treats it as a string. After that, you can
convert the entire value to JSON and extract the required information.

## See Also

[Salesforce Help](https://help.salesforce.com)

<!-- document id=1edcb7ce69b3b64602163ac8e0403fd39fc140af73af38ea843d02a5cd4734aa url=/mulesoft/current/en-us/amazon-secrets-manager-properties-provider-connector/1.1/amazon-secrets-manager-examples.md -->

---
product: Amazon Secrets Manager Properties Provider
version: 1.1
---

# Amazon Secrets Manager Properties Provider Examples

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

The following examples enable you how to configure Amazon Secrets Manager Properties Provider to
retrieve your secrets from Amazon Secrets Manager cloud service

> [!NOTE] When using dynamic configurations (such as `#[]`), the configuration lifecycle differs
> significantly from static configurations (such as `${}`). For more information, see
> [Dynamic Configuration Lifecycle](https://docs.mulesoft.com/mule-sdk/latest/static-dynamic-configs#dynamic-configuration-lifecycle).

## Configure AWS Connection Types

Anypoint Connectors can use Amazon Secrets Manager Properties Provider in their configurations. The
following example illustrates how to configure the AWS connection type in the **AWS Secrets Manager
Properties Override Config** of Anypoint Studio:

1.  In Studio, navigate to the **Global Elements** tab.

2.  Click **Create**.

3.  In the **Choose Global Type** window, type `AWS Secrets Manager`.

4.  Select **AWS Secrets Manager Properties Override Config**.

5.  Click **OK**.

6.  In the **Global Element Properties** window, you can configure the following fields:

<table><colgroup><col> <col> <col> <col> <col></colgroup><thead><tr><th>Name</th><th>Type</th><th>Description</th><th>Default Value</th><th>Required</th></tr></thead><tbody><tr><td><p><strong>AWS Secrets Manager Region</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>AWS Secrets Manager region, for example, <code>us-east-2</code>.</p></div></div></td><td><div></div></td><td><div><div><p>x</p></div></div></td></tr><tr><td><p><strong>AWS Access Key</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>AWS access key ID.</p></div></div></td><td><div></div></td><td><div></div></td></tr><tr><td><p><strong>AWS Secret Key a</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>AWS secret key ID.</p></div></div></td><td><div></div></td><td><div></div></td></tr><tr><td><p><strong>Role ARN</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>Uniquely identifies a role to gain cross-account access.</p></div></div></td><td><div></div></td><td><div></div></td></tr><tr><td><p><strong>External ID</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>The External ID is used to prevent the confused deputy problem when assuming a role in another account.</p></div></div></td><td><div></div></td><td><div></div></td></tr></tbody></table>

![Example of Amazon Secrets Manager Properties Provider in Global Element Properties window of Anypoint Studio](/mulesoft/current/en-us/amazon-secrets-manager-properties-provider-connector/1.1/_images/amazon-secrets-manager-properties.png)

In the **Configuration XML** editor, the configuration looks like this:

```xml
  <aws-secrets-manager-properties-override:config name="AWS_Secrets_Manager_Properties_Override_Config" doc:name="AWS Secrets Manager Properties Override Config" doc:id="4507e2b4-3205-4400-b903-848dcba504a7" >
		<aws-secrets-manager-properties-override:basic-connection region="us-east-1" />
		<aws-secrets-manager-properties-override:role-connection roleARN="arn:aws:iam::480410955647:role/AmazonSSMRoleForAutomationAssumeQuickSetup" externalId="38cf7bd2-decf-4ac3-8cff-cbad32f29bg9" />
	</aws-secrets-manager-properties-override:config>
```

If you do not provide credentials, the default AWS connection follows the
[default credentials provider chain - AWS SDK for Java 2.x](https://docs.aws.amazon.com/sdk-for-java/latest/developer-guide/credentials-chain.html).
This chain enables you to supply AWS credentials and the region through runtime environment
variables (for example, `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, and `AWS_REGION`) instead of
hardcoding them in the Mule app configuration. For the list of supported environment variables and a
configuration example, see
[Environment Variables](https://docs.mulesoft.com/amazon-secrets-manager-properties-provider-connector/1.1/amazon-secrets-manager-properties-provider-reference#environment-variables).

## Configure AWS Secrets Manager Using a JSON String

The following example shows how to configure the Amazon Secrets Manager Properties Provider for
Amazon S3 Connector by using a JSON string where you create the secret manager keys.

Based on a JSON file that contains `accessKey` and `secretKey`:

aws secretsmanager create-secret --name aws-credentials --secret-string '{"accessKey":"ACCESSKEY",
"secretKey":"SECRET"}'

1.  In the **Amazon S3 Configuration** global element properties window, select **fx** to set
    expression values.

2.  Set **Access Key** to `${aws-secrets::aws-credentials}.accessKey`.

3.  Set **Secret Key** to `${aws-secrets::aws-credentials}.secretKey`.

![Example of Amazon Secrets Manager Properties Provider configuration for Amazon S3 Connector with JSON expression](/mulesoft/current/en-us/amazon-secrets-manager-properties-provider-connector/1.1/_images/aws-sm-json-1.png)

In the **Configuration XML** editor, the configuration looks like this:

```xml
<s3:config name="Amazon_S3_Configuration" doc:name="Amazon S3 Configuration">
		<s3:connection accessKey="#[${aws-secrets::aws-credentials}.accessKey]" secretKey="#[${aws-secrets::aws-credentials}.secretKey]" />
	</s3:config>
```

### Handle JSON Keys with Dots

If your JSON secret contains keys with dots in their names, DataWeave treats the dots as subtrees in
JSON. Make sure that configuration fields are set to `Expression mode` (fx button enabled) when
using these syntaxes.

For example, with this JSON structure, access the value using
`${aws-secrets::mySecretName}.'myProject.demo.accessKey'`.

{ "myProject.demo.accessKey": "XXXXXXXX", "myProject.demo.secretKey": "XXXXXXXX",
"myProject.demo.region": "us-east-1", "myProject.demo.roleArn":
"arn:aws:iam::XXXXXXXXXXX:role/AmazonDemoTestRole", "myProject.example.http.Port": "8081" }

For example, with this JSON structure, access the value using
`${aws-secrets::mySecretName}.myProject.demo.accessKey`.

{ "myProject": { "demo": { "accessKey": "XXXXXXXX", "secretKey": "XXXXXXXX", "region": "us-east-1",
"roleArn": "arn:aws:iam::XXXXXXXXXXX:role/AmazonDemoTestRole" } } }

#### Example: Using JSON Keys with Dots With IBM Connector Configuration

This example shows how to configure IBM MQ Connector using JSON keys with dots in their names:

```xml
<ibm-mq:config name="IBM_MQ_Config" doc:name="IBM MQ Config">
	<ibm-mq:connection username="#[${aws-secrets::mySecretName}.'myProject.example.user']" password="#[${aws-secrets::mySecretName}.'myProject.example.pass']">
		<ibm-mq:connection-mode>
			<ibm-mq:client host="localhost" queueManager="QM1" channel="dummyChannel"/>
		</ibm-mq:connection-mode>
	</ibm-mq:connection>
</ibm-mq:config>
```

## Configure AWS Secrets Manager as a String

The following example shows how to configure the secret manager keys as a string for Amazon S3
Connector.

Based on the following string:

aws secretsmanager create-secret --name accessKey --secret-string "ACCESSKEY" aws secretsmanager
create-secret --name secretKey --secret-string "SECRET"

In the **Amazon S3 Configuration** global element properties window:

1.  Set **Access Key** to `${aws-secrets::accessKey}`.

2.  Set **Secret Key** to `${aws-secrets::secretKey}`.

![Example of Amazon Secrets Manager Properties Provider configuration for Amazon S3 Connector with a string value](/mulesoft/current/en-us/amazon-secrets-manager-properties-provider-connector/1.1/_images/aws-sm-json-2.png)

In the **Configuration XML** editor, the configuration looks like this:

```xml
<s3:config name="Amazon_S3_Configuration" doc:name="Amazon S3 Configuration" >
		<s3:connection accessKey="${aws-secrets::accessKey}" secretKey="${aws-secrets::secretKey}" />
	</s3:config>
```

Avoid using the `$` special character in values stored in the secret manager. If you must use the
`$` character, use the variable in literal mode, which treats it as a string. After that, you can
convert the entire value to JSON and extract the required information.

## See Also

[Salesforce Help](https://help.salesforce.com)

<!-- document id=e0b910c87412bf08c6df46823d98bb1889d69f25eb29194caebe213de8c28cc6 url=/mulesoft/current/en-us/amazon-secrets-manager-properties-provider-connector/latest/amazon-secrets-manager-examples.md -->

---
product: Amazon Secrets Manager Properties Provider
version: 1.2
is-latest-version: true
---

# Amazon Secrets Manager Properties Provider Examples

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

The following examples enable you how to configure Amazon Secrets Manager Properties Provider to
retrieve your secrets from Amazon Secrets Manager cloud service

> [!NOTE] When using dynamic configurations (such as `#[]`), the configuration lifecycle differs
> significantly from static configurations (such as `${}`). For more information, see
> [Dynamic Configuration Lifecycle](https://docs.mulesoft.com/mule-sdk/latest/static-dynamic-configs#dynamic-configuration-lifecycle).

## Configure AWS Connection Types

Anypoint Connectors can use Amazon Secrets Manager Properties Provider in their configurations. The
following example illustrates how to configure the AWS connection type in the **AWS Secrets Manager
Properties Override Config** of Anypoint Studio:

1.  In Studio, navigate to the **Global Elements** tab.

2.  Click **Create**.

3.  In the **Choose Global Type** window, type `AWS Secrets Manager`.

4.  Select **AWS Secrets Manager Properties Override Config**.

5.  Click **OK**.

6.  In the **Global Element Properties** window, you can configure the following fields:

<table><colgroup><col> <col> <col> <col> <col></colgroup><thead><tr><th>Name</th><th>Type</th><th>Description</th><th>Default Value</th><th>Required</th></tr></thead><tbody><tr><td><p><strong>AWS Secrets Manager Region</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>AWS Secrets Manager region, for example, <code>us-east-2</code>.</p></div></div></td><td><div></div></td><td><div><div><p>x</p></div></div></td></tr><tr><td><p><strong>AWS Access Key</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>AWS access key ID.</p></div></div></td><td><div></div></td><td><div></div></td></tr><tr><td><p><strong>AWS Secret Key a</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>AWS secret key ID.</p></div></div></td><td><div></div></td><td><div></div></td></tr><tr><td><p><strong>Custom Endpoint URL</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>Custom endpoint URL that overrides the default regional AWS Secrets Manager endpoint. Use this field to route Secrets Manager calls through an AWS VPC interface endpoint (AWS PrivateLink) or to a local testing service such as LocalStack, for example, <code>http://localhost:4566</code>. When unset, the connector uses the default regional AWS endpoint.</p></div></div></td><td><div></div></td><td><div></div></td></tr><tr><td><p><strong>Role ARN</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>Uniquely identifies a role to gain cross-account access.</p></div></div></td><td><div></div></td><td><div></div></td></tr><tr><td><p><strong>External ID</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>The External ID is used to prevent the confused deputy problem when assuming a role in another account.</p></div></div></td><td><div></div></td><td><div></div></td></tr><tr><td><p><strong>STS Endpoint URL</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>Custom endpoint URL that overrides the default regional AWS STS endpoint used when assuming a role. Configure this field independently of <strong>Custom Endpoint URL</strong> to route AWS STS calls through a separate VPC interface endpoint. When unset, the connector uses the default regional AWS STS endpoint.</p></div></div></td><td><div></div></td><td><div></div></td></tr></tbody></table>

![Example of Amazon Secrets Manager Properties Provider in Global Element Properties window of Anypoint Studio](/mulesoft/current/en-us/amazon-secrets-manager-properties-provider-connector/latest/_images/amazon-secrets-manager-properties.png)

In the **Configuration XML** editor, the configuration looks like this:

```xml
  <aws-secrets-manager-properties-override:config name="AWS_Secrets_Manager_Properties_Override_Config" doc:name="AWS Secrets Manager Properties Override Config" doc:id="4507e2b4-3205-4400-b903-848dcba504a7" >
		<aws-secrets-manager-properties-override:basic-connection region="us-east-1" />
		<aws-secrets-manager-properties-override:role-connection roleARN="arn:aws:iam::480410955647:role/AmazonSSMRoleForAutomationAssumeQuickSetup" externalId="38cf7bd2-decf-4ac3-8cff-cbad32f29bg9" />
	</aws-secrets-manager-properties-override:config>
```

If you do not provide credentials, the default AWS connection follows the
[default credentials provider chain - AWS SDK for Java 2.x](https://docs.aws.amazon.com/sdk-for-java/latest/developer-guide/credentials-chain.html).
This chain enables you to supply AWS credentials and the region through runtime environment
variables (for example, `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, and `AWS_REGION`) instead of
hardcoding them in the Mule app configuration. For the list of supported environment variables and a
configuration example, see
[Environment Variables](https://docs.mulesoft.com/amazon-secrets-manager-properties-provider-connector/latest/amazon-secrets-manager-properties-provider-reference#environment-variables).

## Configure AWS Secrets Manager Using a JSON String

The following example shows how to configure the Amazon Secrets Manager Properties Provider for
Amazon S3 Connector by using a JSON string where you create the secret manager keys.

Based on a JSON file that contains `accessKey` and `secretKey`:

aws secretsmanager create-secret --name aws-credentials --secret-string '{"accessKey":"ACCESSKEY",
"secretKey":"SECRET"}'

1.  In the **Amazon S3 Configuration** global element properties window, select **fx** to set
    expression values.

2.  Set **Access Key** to `${aws-secrets::aws-credentials}.accessKey`.

3.  Set **Secret Key** to `${aws-secrets::aws-credentials}.secretKey`.

![Example of Amazon Secrets Manager Properties Provider configuration for Amazon S3 Connector with JSON expression](/mulesoft/current/en-us/amazon-secrets-manager-properties-provider-connector/latest/_images/aws-sm-json-1.png)

In the **Configuration XML** editor, the configuration looks like this:

```xml
<s3:config name="Amazon_S3_Configuration" doc:name="Amazon S3 Configuration">
		<s3:connection accessKey="#[${aws-secrets::aws-credentials}.accessKey]" secretKey="#[${aws-secrets::aws-credentials}.secretKey]" />
	</s3:config>
```

### Handle JSON Keys with Dots

If your JSON secret contains keys with dots in their names, DataWeave treats the dots as subtrees in
JSON. Make sure that configuration fields are set to `Expression mode` (fx button enabled) when
using these syntaxes.

For example, with this JSON structure, access the value using
`${aws-secrets::mySecretName}.'myProject.demo.accessKey'`.

{ "myProject.demo.accessKey": "XXXXXXXX", "myProject.demo.secretKey": "XXXXXXXX",
"myProject.demo.region": "us-east-1", "myProject.demo.roleArn":
"arn:aws:iam::XXXXXXXXXXX:role/AmazonDemoTestRole", "myProject.example.http.Port": "8081" }

For example, with this JSON structure, access the value using
`${aws-secrets::mySecretName}.myProject.demo.accessKey`.

{ "myProject": { "demo": { "accessKey": "XXXXXXXX", "secretKey": "XXXXXXXX", "region": "us-east-1",
"roleArn": "arn:aws:iam::XXXXXXXXXXX:role/AmazonDemoTestRole" } } }

#### Example: Using JSON Keys with Dots With IBM Connector Configuration

This example shows how to configure IBM MQ Connector using JSON keys with dots in their names:

```xml
<ibm-mq:config name="IBM_MQ_Config" doc:name="IBM MQ Config">
	<ibm-mq:connection username="#[${aws-secrets::mySecretName}.'myProject.example.user']" password="#[${aws-secrets::mySecretName}.'myProject.example.pass']">
		<ibm-mq:connection-mode>
			<ibm-mq:client host="localhost" queueManager="QM1" channel="dummyChannel"/>
		</ibm-mq:connection-mode>
	</ibm-mq:connection>
</ibm-mq:config>
```

## Configure AWS Secrets Manager as a String

The following example shows how to configure the secret manager keys as a string for Amazon S3
Connector.

Based on the following string:

aws secretsmanager create-secret --name accessKey --secret-string "ACCESSKEY" aws secretsmanager
create-secret --name secretKey --secret-string "SECRET"

In the **Amazon S3 Configuration** global element properties window:

1.  Set **Access Key** to `${aws-secrets::accessKey}`.

2.  Set **Secret Key** to `${aws-secrets::secretKey}`.

![Example of Amazon Secrets Manager Properties Provider configuration for Amazon S3 Connector with a string value](/mulesoft/current/en-us/amazon-secrets-manager-properties-provider-connector/latest/_images/aws-sm-json-2.png)

In the **Configuration XML** editor, the configuration looks like this:

```xml
<s3:config name="Amazon_S3_Configuration" doc:name="Amazon S3 Configuration" >
		<s3:connection accessKey="${aws-secrets::accessKey}" secretKey="${aws-secrets::secretKey}" />
	</s3:config>
```

Avoid using the `$` special character in values stored in the secret manager. If you must use the
`$` character, use the variable in literal mode, which treats it as a string. After that, you can
convert the entire value to JSON and extract the required information.

## See Also

[Salesforce Help](https://help.salesforce.com)