AWS/Secrets Manager/Secret

• AWS/Secrets Manager secret

  • A secret is one opaque value in a single field — SecretString (text) or SecretBinary (bytes), never both. CreateSecret API reference: "Either SecretString or SecretBinary must have a value, but not both."
  • That one field can hold either shape:
    • AWS/Secrets Manager/Secret/SecretString — one raw string, no internal structure (codekiln's single-valued; AWS console's Plaintext tab).
    • AWS/Secrets Manager/Secret/KeyValue — a JSON object serialized into that same field (codekiln's multi-valued; AWS console's Key/value pairs tab).
  • The console nudges toward the key/value shape even outside a recognized database type. CreateSecret API reference: "If you create a secret by using the Secrets Manager console then Secrets Manager puts the protected secret text in only the SecretString parameter. The Secrets Manager console stores the information as a JSON structure of key/value pairs that a Lambda rotation function can parse."
  • The / in a name like myapp/database-url is not a path into a JSON object — it is one ordinary allowed character in one flat secret name. CreateSecret API reference: "The secret name can contain ASCII letters, numbers, and the following characters: /_+=.@-." There is no parent/child relationship between secrets in Secrets Manager; / is purely a naming convention people use to group related names, the same way S3 object keys use / without real folders existing.