Skip to content
VeraDocs
Back to main site

AWS Secrets Manager

Store made-up secret values, read versions and exercise deletion and recovery state.

Plan: Free23 of 23 operations implemented2Known differences

Use test values only; rotation and regional replication do not establish a real secret-management backend.

Example checked on Vera 1.2.2, 8 November 2026. Each coverage note names its own evidence and date.

Connect

Section titled “Connect”

This Free service needs no license key. Start Vera as in Get started, then run this in a terminal of its own, from an empty scratch directory. It gives the official AWS CLI dummy credentials and a config file of its own, so no AWS account is needed and your own AWS profile isn't touched.

Terminal window
export VERA_ENDPOINT="http://localhost:5003"
export AWS_ACCESS_KEY_ID=test AWS_SECRET_ACCESS_KEY=test
export AWS_REGION=us-east-1 AWS_DEFAULT_REGION=us-east-1
export AWS_SHARED_CREDENTIALS_FILE=/dev/null
export AWS_EC2_METADATA_DISABLED=true
export AWS_PAGER="" AWS_CLI_AUTO_PROMPT=off
unset AWS_PROFILE AWS_DEFAULT_PROFILE
unset AWS_SESSION_TOKEN AWS_SECURITY_TOKEN
unset AWS_WEB_IDENTITY_TOKEN_FILE AWS_ROLE_ARN AWS_ROLE_SESSION_NAME
unset AWS_CONTAINER_CREDENTIALS_FULL_URI
unset AWS_CONTAINER_CREDENTIALS_RELATIVE_URI
cat > vera-aws-config <<'EOF'
[default]
region = us-east-1
output = json
cli_binary_format = base64
s3 =
    addressing_style = path
EOF
export AWS_CONFIG_FILE="$PWD/vera-aws-config"

When you've finished every example in this terminal, close it and delete vera-aws-config, not before.

The emulator serves Secrets Manager’s 2017-10-17 API over the AWS JSON protocol, through the AWS CLI’s secretsmanager commands. A secret’s ARN names the account configured on your Vera instance and ends with a random suffix, such as arn:aws:secretsmanager:us-east-1:123456789012:secret:docs-example-secret-9d8ad6. Commands can name the secret instead.

Example

Section titled “Example”

Create a secret, give it a second value, and see which version is current. Use made-up values, never real secrets. The example needs no files.

Terminal window
aws --endpoint-url "$VERA_ENDPOINT" secretsmanager create-secret \
  --name docs-example-secret --secret-string first.example.net
aws --endpoint-url "$VERA_ENDPOINT" secretsmanager get-secret-value --secret-id docs-example-secret

The read returns SecretString: first.example.net. Store a second value, and describe the secret:

Terminal window
aws --endpoint-url "$VERA_ENDPOINT" secretsmanager put-secret-value \
  --secret-id docs-example-secret --secret-string second.example.net
aws --endpoint-url "$VERA_ENDPOINT" secretsmanager describe-secret --secret-id docs-example-secret

The first version is now AWSPREVIOUS and the new one AWSCURRENT. These are the main fields; the ARN’s suffix and the version IDs differ on every run:

Output (selected fields)
{
    "Name": "docs-example-secret",
    "ARN": "arn:aws:secretsmanager:us-east-1:123456789012:secret:docs-example-secret-9d8ad6",
    "VersionIdsToStages": {
        "875c3132-5c8f-47b1-bf5d-48276d020582": [
            "AWSPREVIOUS"
        ],
        "9b68e3df-4830-4ad2-8147-e79b1a9eeb3d": [
            "AWSCURRENT"
        ]
    }
}

Read the secret again:

Terminal window
aws --endpoint-url "$VERA_ENDPOINT" secretsmanager get-secret-value --secret-id docs-example-secret

It returns the new version: SecretString: second.example.net, with VersionStages holding only AWSCURRENT.

To clean up, delete the secret without a recovery window:

Terminal window
aws --endpoint-url "$VERA_ENDPOINT" secretsmanager delete-secret \
  --secret-id docs-example-secret --force-delete-without-recovery

The response’s DeletionDate is the time of the call.

Supported features

Section titled “Supported features”
  • Secrets with a string value, created, described and deleted.
  • Versions and stages: PutSecretValue adds a version that becomes AWSCURRENT, the one before becomes AWSPREVIOUS, and GetSecretValue returns the current one.
  • Recovery: deleting with a seven-day recovery window schedules the deletion, and reading the secret then answers InvalidRequestException. RestoreSecret brings it back, and the same current value reads back.
  • Rotation and replication, as metadata: RotateSecret adds a version, ReplicateSecretToRegions records a replica region and RemoveRegionsFromReplication removes it. Neither does what AWS does: see Limitations.
  • Also served, not yet tested: batch reads, listing secrets and their versions, updates and stage moves, resource policies, random passwords and tags.

Limitations

Section titled “Limitations”

The main limits are below. A few more apply to every service, and the API coverage notes cover smaller differences.

  • Not a secure store. Only made-up values were tested. Protection at rest and encryption with a KMS key weren’t established.
  • Replicas aren’t readable. ReplicateSecretToRegions reported us-west-2 as InSync, but reading the secret by name in us-west-2 answered HTTP 400 ResourceNotFoundException. Replication is metadata on the local secret, not data in another region.
  • Remove replica regions before deleting. Deleting a secret that still had replica metadata answered InvalidParameterException. After RemoveRegionsFromReplication returned an empty replication status list, deleting worked.
  • Rotation runs no function. RotateSecret produced a new current version holding the same value. Earlier source inspection, on 3 November 2026, found that it doesn’t invoke the configured rotation function.
  • Not tested: whether a secret is deleted when its recovery window ends, stage label conflicts, repeated client request tokens, binary values, random passwords, policy enforcement and version limits.

API coverage

Section titled “API coverage”

Every operation in AWS's published 2017-10-17 API (SDK model, botocore 1.43.105), and whether the emulator implements it. Availability combines the earlier implementation inventory with the dated observations below; checking a page's example does not verify every operation. Each note names its evidence first; an observation given without a build or date comes from earlier testing, on 3 November 2026. What the statuses mean

OperationStatusNotes
BatchGetSecretValueImplemented
CancelRotateSecretImplemented
CreateSecretImplementedLocal observation: Vera 1.2.0 preview, 5 November 2026 — created a secret with a string value.
DeleteResourcePolicyImplemented
DeleteSecretImplementedLocal observation: Vera 1.2.0 preview, 5 November 2026 — with --force-delete-without-recovery, returned a DeletionDate of the time of the call. With a seven-day recovery window, scheduled the deletion. With replica metadata still on the secret, answered InvalidParameterException. Whether a secret is deleted when its window ends wasn't tested.
DescribeSecretImplementedLocal observation: Vera 1.2.0 preview, 5 November 2026 — VersionIdsToStages mapped the old version ID to AWSPREVIOUS and the new one to AWSCURRENT.
GetRandomPasswordImplemented
GetResourcePolicyImplemented
GetSecretValueImplementedLocal observation: Vera 1.2.0 preview, 5 November 2026 — returned the current SecretString in the AWSCURRENT stage, and answered InvalidRequestException while the secret was scheduled for deletion. For the replica region's read, see ReplicateSecretToRegions.
ListSecretVersionIdsImplemented
ListSecretsImplemented
PutResourcePolicyImplemented
PutSecretValueImplementedLocal observation: Vera 1.2.0 preview, 5 November 2026 — added a version that became AWSCURRENT, and moved the previous one to AWSPREVIOUS.
RemoveRegionsFromReplicationImplementedLocal observation: Vera 1.2.0 preview, 5 November 2026 — removed the replica region and returned an empty replication status list, after which the secret could be deleted.
ReplicateSecretToRegionsKnown differenceLocal observation: Vera 1.2.0 preview, 5 November 2026 — reported us-west-2 as InSync, but reading the secret by name in us-west-2 answered HTTP 400 ResourceNotFoundException. Source inspection: 3 November 2026 — Updates replication-status metadata on the local secret; this path does not create independent destination-region secret data.
RestoreSecretImplementedLocal observation: Vera 1.2.0 preview, 5 November 2026 — restored a secret scheduled for deletion, which then read back with the same current value.
RotateSecretKnown differenceLocal observation: Vera 1.2.0 preview, 5 November 2026 — produced a new current version containing the same value. Source inspection: 3 November 2026 — Copies the current secret value into a new version, changes its staging labels and records rotation time without invoking the configured rotation function.
StopReplicationToReplicaImplemented
TagResourceImplemented
UntagResourceImplemented
UpdateSecretImplemented
UpdateSecretVersionStageImplemented
ValidateResourcePolicyImplemented