---
subcategory: "Secrets Manager"
layout: "aws"
page_title: "AWS: aws_secretsmanager_secret_version"
description: |-
  Provides a resource to manage AWS Secrets Manager secret version including its secret value
---

# Resource: aws_secretsmanager_secret_version

Provides a resource to manage AWS Secrets Manager secret version including its secret value. To manage secret metadata, see the [`aws_secretsmanager_secret` resource](/docs/providers/aws/r/secretsmanager_secret.html).

~> **NOTE:** If the `AWSCURRENT` staging label is present on this version during resource deletion, that label cannot be removed and will be skipped to prevent errors when fully deleting the secret. That label will leave this secret version active even after the resource is deleted from Terraform unless the secret itself is deleted. Move the `AWSCURRENT` staging label before or after deleting this resource from Terraform to fully trigger version deprecation if necessary.

-> **Note:** Write-Only argument `secret_string_wo` is available to use in place of `secret_string`. Write-Only argumentss are supported in HashiCorp Terraform 1.11.0 and later. [Learn more](https://developer.hashicorp.com/terraform/language/resources/ephemeral#write-only-arguments).

~> **NOTE:** This resource manages one specific version of a secret. If something else creates newer versions, such as rotation, another Terraform configuration, or the console, this resource keeps tracking its own version even after that version is no longer `AWSCURRENT`. To read the current value of a secret, use the [`aws_secretsmanager_secret_version` data source](/docs/providers/aws/d/secretsmanager_secret_version.html).

~> **NOTE:** When a secret's KMS key changes, Secrets Manager re-encrypts only the `AWSCURRENT`, `AWSPENDING`, and `AWSPREVIOUS` versions with the new key. Once the previous key is disabled or deleted, older versions can no longer be decrypted. If this resource's version is one of them, Terraform keeps the value from state and shows a warning, but cannot import the version or move staging labels onto it. If the version is still `AWSCURRENT` or `AWSPENDING`, reading it fails. See [Change the encryption key for a secret](https://docs.aws.amazon.com/secretsmanager/latest/userguide/manage_update-encryption-key.html).

## Example Usage

### Simple String Value

```terraform
resource "aws_secretsmanager_secret_version" "example" {
  secret_id     = aws_secretsmanager_secret.example.id
  secret_string = "example-string-to-protect"
}
```

### Key-Value Pairs

Secrets Manager also accepts key-value pairs in JSON.

```terraform
# The map here can come from other supported configurations
# like locals, resource attribute, map() built-in, etc.
variable "example" {
  default = {
    key1 = "value1"
    key2 = "value2"
  }

  type = map(string)
}

resource "aws_secretsmanager_secret_version" "example" {
  secret_id     = aws_secretsmanager_secret.example.id
  secret_string = jsonencode(var.example)
}
```

-> **Note:** In Terraform 0.14 and later, use `sensitive = true` to protect the values of the variable from being printed in logs and console output (see [Protect Sensitive Input Variables](https://learn.hashicorp.com/tutorials/terraform/sensitive-variables)).

Reading key-value pairs from JSON back into a native Terraform map can be accomplished in Terraform 0.12 and later with the [`jsondecode()` function](https://www.terraform.io/docs/configuration/functions/jsondecode.html):

```terraform
output "example" {
  value = jsondecode(aws_secretsmanager_secret_version.example.secret_string)["key1"]
}
```

## Argument Reference

This resource supports the following arguments:

* `region` - (Optional) Region where this resource will be [managed](https://docs.aws.amazon.com/general/latest/gr/rande.html#regional-endpoints). Defaults to the Region set in the [provider configuration](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#aws-configuration-reference).
* `secret_binary` - (Optional) Binary data that you want to encrypt and store in this version of the secret. This is required if `secret_string` or `secret_string_wo` is not set. Needs to be encoded to base64.
* `secret_id` - (Required) Secret to which you want to add a new version. You can specify either the ARN or the friendly name of the secret. The secret must already exist.
* `secret_string` - (Optional) Text data that you want to encrypt and store in this version of the secret. This is required if `secret_binary` or `secret_string_wo` is not set.
* `secret_string_wo` - (Optional, Write-Only) Text data that you want to encrypt and store in this version of the secret. This is required if `secret_binary` or `secret_string` is not set. If set, requires `secret_string_wo_version` to be set.
* `secret_string_wo_version` - (Optional) Required when `secret_string_wo` is set. Changing this value triggers an update to `secret_string_wo`.
* `version_stages` - (Optional) List of staging labels that are attached to this version of the secret. A staging label must be unique to a single version of the secret. If you specify a staging label that's already associated with a different version of the same secret then that staging label is automatically removed from the other version and attached to this version. If you do not specify a value, then AWS Secrets Manager automatically moves the staging label `AWSCURRENT` to this new version on creation.

~> **NOTE:** If `version_stages` is configured, you must include the `AWSCURRENT` staging label if this secret version is the only version or if the label is currently present on this secret version, otherwise Terraform will show a perpetual difference.

## Attribute Reference

This resource exports the following attributes in addition to the arguments above:

* `arn` - (**Deprecated**) ARN of the secret. Use `secret_arn` instead.
* `has_secret_string_wo` - Whether a write-only secret string value is set.
* `secret_arn` - ARN of the secret.
* `version_id` - Unique identifier of the version of the secret.

## Import

In Terraform v1.12.0 and later, the [`import` block](https://developer.hashicorp.com/terraform/language/import) can be used with the `identity` attribute. For example:

```terraform
import {
  to = aws_secretsmanager_secret_version.example
  identity = {
    secret_id  = "arn:aws:secretsmanager:us-east-1:123456789012:secret:example-123456"
    version_id = "xxxxx-xxxxxxx-xxxxxxx-xxxxx"
  }
}

resource "aws_secretsmanager_secret_version" "example" {
  ### Configuration omitted for brevity ###
}
```

### Identity Schema

#### Required

* `secret_id` - (String) ID of the secret.
* `version_id` - (String) ID of the secret version.

#### Optional

* `account_id` (String) AWS Account where this resource is managed.
* `region` (String) Region where this resource is managed.

In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import `aws_secretsmanager_secret_version` using the secret ID and version ID. For example:

```terraform
import {
  to = aws_secretsmanager_secret_version.example
  id = "arn:aws:secretsmanager:us-east-1:123456789012:secret:example-123456|xxxxx-xxxxxxx-xxxxxxx-xxxxx"
}
```

Using `terraform import`, import `aws_secretsmanager_secret_version` using the secret ID and version ID. For example:

```console
% terraform import aws_secretsmanager_secret_version.example 'arn:aws:secretsmanager:us-east-1:123456789012:secret:example-123456|xxxxx-xxxxxxx-xxxxxxx-xxxxx'
```