Integration

AWS Secrets Manager integration

AWS Secrets Manager API for storing, rotating, and retrieving secrets like database credentials, API keys, and tokens. Provides automatic rotation, fine-grained access control, and audit logging for sensitive information.

Connect AWS Secrets Manager How integrations work

Ask it in chat

Say what should happen.
The workflow builds itself.

When this happens, do that in AWS Secrets Manager.Built from the 23 AWS Secrets Manager tools below, on the connection you add once.

Common AWS Secrets Manager use cases

automate secret management
automate resource policy management
automate resource management
automate secret value management
list secret programmatically
tag resource programmatically
create secret programmatically
delete secret programmatically
remove region programmatically
rotate secret programmatically

What you can do with AWS Secrets Manager

Each of these is one operation on one endpoint, available both as a workflow step and as a tool an AI agent can call on its own. Nothing bundles several operations into one action, so what a run did stays readable afterwards.

Most endpoints run on the free plan. A few, mainly the ones that publish on your behalf, need a paid plan.

Secret, 7 operations

create_secretCreate secretPOSTCreate a new secret in AWS Secrets Manager. The secret can store a text string (SecretString) or binary data (SecretBinary). Optionally specify a KMS key for encryption, tags, and automatic rotation configuration.
delete_secretDelete secretPOSTDelete a secret. By default the secret enters a recovery window (7-30 days) before permanent deletion. Use ForceDeleteWithoutRecovery to delete immediately (cannot be undone).
describe_secretDescribe secretPOSTRetrieve metadata about a secret (name, ARN, description, tags, rotation configuration, version info). Does NOT return the secret value itself.
list_secretsList secretsPOSTList all secrets in the current AWS account and region. Supports pagination, filtering by name/tag/description/primary region/owning service, and sorting.
restore_secretRestore secretPOSTCancel the scheduled deletion of a secret. Restores a secret that is in the pending deletion state (within its recovery window) back to active status.
rotate_secretRotate secretPOSTConfigure automatic rotation for a secret and optionally trigger an immediate rotation. Requires an AWS Lambda function that implements the rotation logic.
update_secretUpdate secretPOSTUpdate metadata or the value of an existing secret. Can change description, KMS key, or secret value (SecretString/SecretBinary). Creates a new version if value changes.

Resource policy, 4 operations

delete_resource_policyDelete resource policyPOSTRemove the resource-based IAM policy from a secret. After deletion, access to the secret is governed solely by identity-based IAM policies.
get_resource_policyGet resource policyPOSTRetrieve the resource-based IAM policy attached to a secret. Returns the JSON policy document if one exists.
put_resource_policyPut resource policyPOSTAttach or replace the resource-based IAM policy on a secret. Used to grant cross-account access or refine permissions beyond identity-based policies.
validate_resource_policyValidate resource policyPOSTValidate an IAM resource policy before attaching it to a secret. Checks for syntax errors and policies that grant overly broad access.

Secret value, 3 operations

batch_get_secret_valueBatch get secret valuePOSTRetrieve the values of up to 20 secrets in a single API call using a list of secret IDs or filter criteria.
get_secret_valueGet secret valuePOSTRetrieve the secret value (decrypted) for a given secret. Returns either SecretString or SecretBinary depending on how the secret was stored. By default returns the AWSCURRENT version.
put_secret_valuePut secret valuePOSTStore a new value for an existing secret, creating a new version. The new version receives the AWSCURRENT staging label; the previous AWSCURRENT version is relabelled AWSPREVIOUS.

Resource, 2 operations

tag_resourceTag resourcePOSTAdd or overwrite tags on a secret. Tags are key-value pairs used for organization, cost allocation, and IAM-based access control.
untag_resourceUntag resourcePOSTRemove one or more tags from a secret by specifying tag keys. Tag values are not required; only keys are needed for removal.

Random password, 1 operation

get_random_passwordGet random passwordPOSTGenerate a cryptographically random password suitable for use as a secret value. Allows fine-grained control over character composition and length.

Region, 1 operation

remove_regions_from_replicationRemove regions from replicationPOSTStop replicating a secret to one or more AWS regions. The replica secret in each specified region is deleted.

Replicate secret, 1 operation

replicate_secret_to_regionsReplicate secret to regionsPOSTReplicate a secret to one or more additional AWS regions. Useful for disaster recovery and multi-region deployments.

Replication, 1 operation

stop_replication_to_replicaStop replication to replicaPOSTStop replication from the primary secret to this replica, promoting the replica to a standalone primary secret in its own region.

Rotate secret, 1 operation

cancel_rotate_secretCancel rotate secretPOSTDisable automatic rotation for a secret. Any in-progress rotation is not cancelled immediately; the Lambda function may still be running. The AWSPENDING version, if any, remains until cleaned up manually.

Secret version id, 1 operation

list_secret_version_idsList secret version idsPOSTList all versions of a specific secret. Each version has a unique ID, staging labels, and creation date. Useful for auditing or managing secret rotation history.

Secret version stage, 1 operation

update_secret_version_stageUpdate secret version stagePOSTMove a staging label from one version of a secret to another. Commonly used during rotation to promote AWSPENDING to AWSCURRENT after testing.

Use AWS Secrets Manager from Claude Code, Cursor or Codex

Connect AWS Secrets Manager in LiveContext, create an API key in Settings, then add the LiveContext MCP server to your client. Its AWS Secrets Manager operations become tools the client can call, next to every other integration you connected.

Claude Code

claude mcp add --transport http livecontext https://livecontext.ai/mcp --header "X-API-Key: YOUR_API_KEY"

Codex (~/.codex/config.toml)

[mcp_servers.livecontext]
url = "https://livecontext.ai/mcp"

[mcp_servers.livecontext.http_headers]
"X-API-Key" = "YOUR_API_KEY"

Cursor, Claude Desktop and other JSON configs

{
  "mcpServers": {
    "livecontext": {
      "type": "http",
      "url": "https://livecontext.ai/mcp",
      "headers": {
        "X-API-Key": "YOUR_API_KEY"
      }
    }
  }
}

Set up the MCP server step by step

How to connect AWS Secrets Manager

Create your workspace
Sign up free. Nothing to install.
Connect AWS Secrets Manager once
Add your AWS Secrets Manager connection in Settings. Every tool from this integration reuses it, and secrets are encrypted at rest and visible only to you.
Describe the job in chat
The workflow builds itself in front of you and picks the endpoints it needs. Drag the steps yourself on the canvas whenever you would rather be explicit.

AWS Secrets Manager integration FAQ

What can you do with the AWS Secrets Manager integration?

LiveContext exposes 23 operations on AWS Secrets Manager, covering secret, resource policy, secret value and resource. Common uses include automate secret management, automate resource policy management and automate resource management.