4

Looking at the man page for list-secrets, there is no special options to show deleted or not. It does not list deleted secrets. However, the output definition includes a "DeletedDate" timestamp.

The ListSecrets API does not show any option for deleted secrets. But again the response includes a DeletedDate.

The boto3 docs for list_secrets() are the same.

However, in the AWS console I can see deleted secrets. A quick look at the dev tools and I can see my request payload to the Secrets Manager endpoint looks like:

{
  "method": "POST",
  "path": "/",
  "headers": {
    "Content-Type": "application/x-amz-json-1.1",
    "X-Amz-Target": "secretsmanager.ListSecrets",
    "X-Amz-Date": "Fri, 27 Nov 2020 13:19:06 GMT"
  },
  "operation": "ListSecrets",
  "content": {
    "MaxResults": 100,
    "IncludeDeleted": true,
    "SortOrder": "asc"
  },
  "region": "eu-west-2"
}

Is there any way to pass "IncludeDeleted": true to the CLI?

Is this a bug? Where do I report it? (I know there is a cloudformation bug tracker on github, I assume secretsmanager would have something similar somewhere..?)

1 Answer 1

5

Save the following file to ~/.aws/models/secretsmanager/2017-10-17/service-2.sdk-extras.json:

{
  "version": 1.0,
  "merge": {
    "shapes": {
      "ListSecretsRequest": {
        "members": {
          "IncludeDeleted": {
            "shape": "BooleanType",
            "documentation": "<p>If set, includes secrets that are disabled.</p>"
          }
        }
      }
    }
  }
}

Then you can list secrets with the CLI as follows:

aws secretsmanager list-secrets --include-deleted

or with boto3:

import boto3


 def list_secrets(session, **kwargs):
     client = session.client("secretsmanager")

     for page in client.get_paginator("list_secrets").paginate(, **kwargs):
         yield from page["SecretList"]


 if __name__ == "__main__":
     session = boto3.Session()

     for secret in list_secrets(session, IncludeDeleted=True):
         if "DeletedDate" in secret:
             print(secret)

This is using the botocore loader mechanism to augment the service model for Secrets Manager, and tell boto3 that "IncludeDeleted" is a parameter for the ListSecrets API.

If you want more detail, I've just posted a blog post explaining what else I tried and how I got to this solution – and thanks to OP, whose dev tool experiments were a useful clue.

2
  • 1
    The approach using CLI did not work for me :( I get Unknown options: --include-deleted
    – Oliver
    Feb 14, 2022 at 17:27
  • see the minor edits above. The solution works.
    – skadya
    Jul 27, 2022 at 4:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.