Struct AwsSecretsManager 

pub struct AwsSecretsManager { /* private fields */ }

AWS Secrets Manager implementation of CloudSecretManager.

This implementation provides:

• Automatic credential discovery (env → file → IAM role)
• Built-in secret caching with TTL
• Support for both string and binary secrets
• Automatic retry with exponential backoff

Example

use llm_shield_cloud_aws::AwsSecretsManager;
use llm_shield_cloud::CloudSecretManager;

#[tokio::main]
async fn main() -> Result<(), Box<dyn std::error::Error>> {
    let manager = AwsSecretsManager::new().await?;
    let secret = manager.get_secret("my-secret").await?;
    println!("Secret: {}", secret.as_string());
    Ok(())
}

Implementations

impl AwsSecretsManager

pub async fn new() -> Result<Self>

Creates a new AWS Secrets Manager client with default configuration.

Uses the AWS credential provider chain:

1. Environment variables (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY)
2. AWS credentials file (~/.aws/credentials)
3. IAM role for ECS task
4. IAM role for EC2 instance
5. IAM role for EKS pod (IRSA)

Errors

Returns error if AWS configuration cannot be loaded.

pub async fn new_with_region(region: impl Into<String>) -> Result<Self>

Creates a new AWS Secrets Manager client with specific region.

Arguments

• region - AWS region (e.g., “us-east-1”, “eu-west-1”)

Errors

Returns error if AWS configuration cannot be loaded.

pub async fn new_with_cache_ttl( region: impl Into<String>, cache_ttl_seconds: u64, ) -> Result<Self>

Creates a new AWS Secrets Manager client with custom cache TTL.

Arguments

• region - AWS region
• cache_ttl_seconds - Cache time-to-live in seconds

Errors

Returns error if AWS configuration cannot be loaded.

pub fn region(&self) -> &str

Gets the AWS region this client is configured for.

pub async fn clear_cache(&self)

Clears the secret cache.

pub async fn cache_size(&self) -> usize

Gets the number of cached secrets.

Trait Implementations

impl CloudSecretManager for AwsSecretsManager

fn get_secret<'life0, 'life1, 'async_trait>( &'life0 self, name: &'life1 str, ) -> Pin<Box<dyn Future<Output = Result<SecretValue>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

Fetches a secret by name.

fn list_secrets<'life0, 'async_trait>( &'life0 self, ) -> Pin<Box<dyn Future<Output = Result<Vec<String>>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait,

Lists all secret names.

fn create_secret<'life0, 'life1, 'life2, 'async_trait>( &'life0 self, name: &'life1 str, value: &'life2 SecretValue, ) -> Pin<Box<dyn Future<Output = Result<()>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait,

Creates a new secret.

fn update_secret<'life0, 'life1, 'life2, 'async_trait>( &'life0 self, name: &'life1 str, value: &'life2 SecretValue, ) -> Pin<Box<dyn Future<Output = Result<()>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait,

Updates an existing secret.

fn delete_secret<'life0, 'life1, 'async_trait>( &'life0 self, name: &'life1 str, ) -> Pin<Box<dyn Future<Output = Result<()>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

Deletes a secret.

fn get_secret_metadata<'life0, 'life1, 'async_trait>( &'life0 self, name: &'life1 str, ) -> Pin<Box<dyn Future<Output = Result<SecretMetadata>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

Gets secret metadata without fetching the value.

fn rotate_secret<'life0, 'life1, 'life2, 'async_trait>( &'life0 self, name: &'life1 str, new_value: &'life2 SecretValue, ) -> Pin<Box<dyn Future<Output = Result<(), CloudError>> + Send + 'async_trait>>

where 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait, Self: 'async_trait,

Rotates a secret (creates a new version).