Secrets

Emulates a managed secret store — the Secrets Manager vault you'd keep database passwords, API keys, and tokens in instead of hardcoding them. You create a named secret with a value, read it back, and update it to roll a new version.

Reach for it in tests when your code fetches a secret at startup, reads a specific version, or rotates a credential — so you can exercise those paths without a live vault. Under the hood each secret is a named entry with a value and a version history that grows on every update.

Create a secret#

A secret is the named entry your value lives in — the equivalent of creating a secret in Secrets Manager. Tags let you organise them the way you would in the real service:

import secdriver "github.com/stackshy/cloudemu/v2/services/secrets/driver"

aws.SecretsManager.CreateSecret(ctx, secdriver.SecretConfig{
    Name:  "db-password",
    Value: "super-secret-123",
    Tags:  map[string]string{"env": "production"},
})

Read a secret#

GetSecret returns the current value — the call your app makes at startup to pull a credential out of the vault:

secret, _ := aws.SecretsManager.GetSecret(ctx, "db-password")
fmt.Println(secret.Value) // "super-secret-123"

Update and read a specific version#

Every update creates a new version rather than overwriting in place, so you can roll a credential and still read older versions — the mechanism behind secret rotation:

// Update creates a new version
aws.SecretsManager.UpdateSecret(ctx, "db-password", "new-password-456")

// Get specific version
secret, _ = aws.SecretsManager.GetSecretVersion(ctx, "db-password", "v2")

List secrets#

ListSecrets enumerates every secret in the store, the way an inventory or admin view would:

secrets, _ := aws.SecretsManager.ListSecrets(ctx)

Behavior & fidelity#

• Updates are versioned, not destructive. Each UpdateSecret adds a new version and leaves earlier ones readable by version ID, mirroring how Secrets Manager stages values — so you can test rotation and rollback.
• Values are opaque payloads. A secret holds whatever string or binary value you store; cloudemu doesn't interpret it.
• SDK-compat status — Portable Go API only. Real aws-sdk-go-v2/service/secretsmanager, azsecrets, and Secret Manager REST clients can't talk to cloudemu yet — secrets SDK-compat handlers are next on the roadmap. The full driver semantics above (versions, rotation, binary payloads) are available today through the Portable Go API.