Configuring AWS Secrets Manager as a secretstore

Configure AWS Secrets Manager as secretstore for managing sensitive credentials in Automation Suite on OpenShift.

You can configure AWS Secrets Manager as a secretstore using Access Keys (Static Credentials).

Note:

Node IAM Role authentication is not supported on OpenShift. For Node IAM Role-based authentication, refer to the EKS/AKS installation guide.

AWS Secrets Manager stores secrets as key-value pairs or plaintext strings.

By default, all sensitive data is defined in input.json. You can separate this data into two parts:

• input.json - contains only configuration data.
• AWS Secrets Manager - stores credentials securely.

Note:

You cannot store certificate paths or certificate-related credentials as part of the secretstore.

Using Access Keys

Access Keys uses explicit AWS access key ID and secret access key stored in a Kubernetes secret.

Prerequisites

• AWS IAM user with secretsmanager:GetSecretValue permissions
• Kubernetes secret pre-created with access key credentials

Configuring input.json

To configure AWS Secrets Manager as a secretstore using Access Keys, take the following steps:

1. Create the Kubernetes secret that stores the AWS credentials:

   kubectl create secret generic aws-credentials \
     --namespace uipath \
     --from-literal=access-key-id=AKIAIOSFODNN7EXAMPLE \
     --from-literal=secret-access-key=wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
   

   The secret must contain the following keys:

   • access-key-id - AWS Access Key ID
   • secret-access-key - AWS Secret Access Key

2. Add the following section to input.json:

   {
     "secret_store": {
       "enabled": true,
       "provider_configs": [
         {
           "name": "aws-prod",
           "type": "aws",
           "credentials_secret_name": "aws-credentials",
           "aws_kv": {
             "region": "us-east-1"
           }
         }
       ]
     }
   }
   

Configuration fields

The following table describes the available configuration fields.

Field	Required	Description
aws_kv.region	Yes	AWS region where secrets are stored (for example, us-east-1)
credentials_secret_name	Yes	Kubernetes secret containing access-key-id and secret-access-key keys

Referencing secrets in input.json

To reference a credential stored in AWS Secrets Manager, use one of the following formats in input.json:

• Plain string: vault/aws-prod/secret-name
• JSON property extraction: vault/aws-prod/secret-name?key=password

Using AWS GovCloud

If you are using AWS GovCloud, set the region field to an AWS GovCloud region (for example, us-gov-west-1 or us-gov-east-1). No other configuration changes are required - the region value determines the AWS partition and endpoints used.

{
  "secret_store": {
    "enabled": true,
    "provider_configs": [
      {
        "name": "aws-gov",
        "type": "aws",
        "credentials_secret_name": "aws-credentials",
        "aws_kv": {
          "region": "us-gov-west-1"
        }
      }
    ]
  }
}