AWS/Secrets Manager/Secret/KeyValue

• AWS/Secrets Manager key/value secret

  • The same AWS/Secrets Manager/Secret field (SecretString) holding a JSON object instead of a bare string, e.g. {"username":"admin","password":"secret"}. AWS's console calls this the Key/value pairs tab. Answer/Official from Create an AWS Secrets Manager secret: "In Key/value pairs, either enter your secret in JSON Key/value pairs..." — its example: an API key entered as ClientID / ClientSecret pairs.
  • codekiln's term for this: multi-valued. There is still exactly one SecretString — "multi-valued" describes how many named fields live inside that one JSON value, not a second storage mechanism.
  • Setting it: console → Store a new secret → Other type of secret → Key/value pairs tab. CLI → aws secretsmanager create-secret --name <name> --secret-string '{"key":"value", ...}' — any valid JSON object string. (Create an AWS Secrets Manager secret)
  • What this unlocks that AWS/Secrets Manager/Secret/SecretString (plaintext) can't:
    • AWS's ready-made rotation Lambda templates for known database-credential shapes — but only one of three rotation paths, and only when the JSON matches the expected schema. Full breakdown with citations: AWS/Secrets Manager/Secret/Rotation.
    • Extracting one field by ARN suffix without app-side JSON parsing. Pass Secrets Manager secrets through Amazon ECS environment variables: "Specifies the name of the key in a key-value pair with the value that you want to set as the environment variable value. Only values in JSON format are supported." fnox mirrors this client-side with its json_path option (provider docs), including dotted nested paths.
    • Storing several related values as one billed resource instead of one per value. AWS Secrets Manager pricing worked example prices a secret "@ $0.40 / secret / month" — one JSON secret with several fields costs the same as one plaintext secret; splitting the same values into N plaintext secrets costs N times as much.