> ## Documentation Index
> Fetch the complete documentation index at: https://infisical-daniel-remove-api-key-auth-docs.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# AWS Secrets Manager

> Learn how to sync secrets from Infisical to AWS Secrets Manager.

Prerequisites:

* Set up and add envars to [Infisical Cloud](https://app.infisical.com)
* Set up AWS and have/create an IAM user

<Steps>
  <Step title="Grant the IAM user permissions to access AWS Secrets Manager">
    Navigate to your IAM user permissions and add a permission policy to grant access to AWS Secrets Manager.

    ![integration IAM 1](https://mintlify.s3-us-west-1.amazonaws.com/infisical-daniel-remove-api-key-auth-docs/images/integrations/aws/integrations-aws-iam-1.png)
    ![integration IAM 2](https://mintlify.s3-us-west-1.amazonaws.com/infisical-daniel-remove-api-key-auth-docs/images/integrations/aws/integrations-aws-secret-manager-iam-2.png)
    ![integrations IAM 3](https://mintlify.s3-us-west-1.amazonaws.com/infisical-daniel-remove-api-key-auth-docs/images/integrations/aws/integrations-aws-secret-manager-iam-3.png)

    For better security, here's a custom policy containing the minimum permissions required by Infisical to sync secrets to AWS Secrets Manager for the IAM user that you can use:

    ```json
    {
      "Version": "2012-10-17",
      "Statement": [
        {
          "Sid": "AllowSecretsManagerAccess",
          "Effect": "Allow",
          "Action": [
            "secretsmanager:GetSecretValue",
            "secretsmanager:CreateSecret",
            "secretsmanager:UpdateSecret"
          ],
          "Resource": "*"
        }
      ]
    }
    ```
  </Step>

  <Step title="Authorize Infisical for AWS Secrets Manager">
    Obtain a AWS access key ID and secret access key for your IAM user in IAM > Users > User > Security credentials > Access keys

    ![access key 1](https://mintlify.s3-us-west-1.amazonaws.com/infisical-daniel-remove-api-key-auth-docs/images/integrations/aws/integrations-aws-access-key-1.png)
    ![access key 2](https://mintlify.s3-us-west-1.amazonaws.com/infisical-daniel-remove-api-key-auth-docs/images/integrations/aws/integrations-aws-access-key-2.png)
    ![access key 3](https://mintlify.s3-us-west-1.amazonaws.com/infisical-daniel-remove-api-key-auth-docs/images/integrations/aws/integrations-aws-access-key-3.png)

    Navigate to your project's integrations tab in Infisical.

    ![integrations](https://mintlify.s3-us-west-1.amazonaws.com/infisical-daniel-remove-api-key-auth-docs/images/integrations.png)

    Press on the AWS Secrets Manager tile and input your AWS access key ID and secret access key from the previous step.

    ![integration auth](https://mintlify.s3-us-west-1.amazonaws.com/infisical-daniel-remove-api-key-auth-docs/images/integrations/aws/integrations-aws-secret-manager-auth.png)

    <Info>
      If this is your project's first cloud integration, then you'll have to grant
      Infisical access to your project's environment variables. Although this step
      breaks E2EE, it's necessary for Infisical to sync the environment variables to
      the cloud platform.
    </Info>
  </Step>

  <Step title="Start integration">
    Select how you want to integration to work by specifying a number of parameters:

    <ParamField path="Project Environment" type="string" required>
      The environment in Infisical from which you want to sync secrets to AWS Secrets Manager.
    </ParamField>

    <ParamField path="Secrets Path" type="string" required>
      The path within the preselected environment form which you want to sync secrets to AWS Secrets Manager.
    </ParamField>

    <ParamField path="AWS Region" type="string" required>
      The region that you want to integrate with in AWS Secrets Manager.
    </ParamField>

    <ParamField path="AWS SM Secret Name" type="string" required>
      The secret name/path in AWS into which you want to sync the secrets from Infisical.
    </ParamField>

    Then, press `Create Integration` to start syncing secrets to AWS Secrets Manager.

    ![integration create](https://mintlify.s3-us-west-1.amazonaws.com/infisical-daniel-remove-api-key-auth-docs/images/integrations/aws/integrations-aws-secret-manager-create.png)

    <Info>
      Infisical currently syncs environment variables to AWS Secrets Manager as
      key-value pairs under one secret. We're actively exploring ways to help users
      group environment variable key-pairs under multiple secrets for greater
      control.
    </Info>

    <Info>
      Please note that upon deleting secrets in Infisical, AWS Secrets Manager immediately makes the secrets inaccessible but only schedules them for deletion after at least 7 days.
    </Info>
  </Step>
</Steps>