Forge Home


Lookup secret values from AWS SecretsManager


16,470 latest version

5.0 quality score

We run a couple of automated
scans to help you access a
module's quality. Each module is
given a score based on how well
the author has formatted their
code and documentation and
modules are also checked for
malware using VirusTotal.

Please note, the information below
is for guidance only and neither of
these methods should be considered
an endorsement by Puppet.

Version information

  • 1.0.1 (latest)
released Nov 12th 2018
This version is compatible with:
  • Puppet Enterprise 2018.1.x, 2017.3.x, 2017.2.x, 2017.1.x, 2016.5.x, 2016.4.x
  • Puppet >= 4.7.0 < 6.0.0
  • , , , , ,

Start using this module

  • r10k or Code Manager
  • Bolt
  • Manual installation
  • Direct download

Add this module to your Puppetfile:

mod 'accenture-hiera_aws_sm', '1.0.1'
Learn more about managing modules with a Puppetfile

Add this module to your Bolt project:

bolt module add accenture-hiera_aws_sm
Learn more about using this module with an existing project

Manually install this module globally with Puppet module tool:

puppet module install accenture-hiera_aws_sm --version 1.0.1

Direct download is not typically how you would use a Puppet module to manage your infrastructure, but you may want to download the module in order to inspect the code.



accenture/hiera_aws_sm — version 1.0.1 Nov 12th 2018


Table of Contents

  1. Description
  2. Setup - The basics of getting started with hiera_aws_secrets_manager
  3. Usage - Configuration options and additional functionality
  4. Reference - An under-the-hood peek at what the module is doing and how
  5. Limitations - OS compatibility, etc.
  6. Development - Guide for contributing to the module


Backend for Hiera 5 which allows lookups against Amazon Secrets Manager.

Based on the design of hiera-vault


Requires the aws-sdk gem to be installed and available to your Puppetmaster.

package {'aws-sdk':
  ensure   => installed
  provider => puppetserver_gem


The following is a reference of a Hiera hierarchy using hiera_aws_sm.


  - name: "Hiera-AWS-SM lookup"
    lookup_key: hiera_aws_sm
      continue_if_not_found: false
      aws_access_key: <aws_access_key>
      aws_secret_key: <aws_secret_key>
      region: us-east-1
      delimiter: /
        - "%{::environment}/%{::trusted.certname}"
        - "%{::environment}/common/"
        - secret/puppet/%{::trusted.certname}/
        - secret/puppet/common/
        - '^aws_.*'

### Mandatory Option Keys

name: Human readable level name

lookup_key: Must be set to hiera_aws_sm

Optional Option Keys

continue_if_not_found: Allow Puppet to lookup other data sources if the key is not found in SecretsManager

aws_access_key: IAM access key to be used to connect to AWS. Should only be used for Puppet masters running outside of AWS. Puppet masters running within AWS should have their access to SecretsManager granted via IAM roles.

aws_secret_key: IAM secret access key to be used to connect to AWS.

region: AWS region to query against

delimiter: Character used to join prefixes and keys if specified. Defaults to /. Not required if prefixes is not set.

prefixes: Optional array of prefixes to prepend to each lookup. For each prefix, the function will perform a lookup of [prefix, key].join(delimiter) against SecretsManager. This allows you to specify multiple paths in SecretsManager for the function to explore, as described above.

confine_to_keys: List of regex expressions on which to search SecretsManager. If specified, hiera_aws_sm will only query SecretsManager for keys matching at least one specified regex. If none match, Puppet is allowed to lookup against other data sources.


This module is only compatible with Hiera 5 (Puppet 4.9+)


pdk test unit


Author: David Hayes []



Release Notes


  • Wrap secret values in Puppet's sensitive data types in examples.
  • Expand README on usage and installation