> ## Documentation Index
> Fetch the complete documentation index at: https://docs.paradime.io/llms.txt
> Use this file to discover all available pages before exploring further.

# AWS Secret Manager

> Reference AWS Secrets Manager secrets by ARN in your Paradime environment variables and connection profiles, without storing plaintext credentials.

Connect AWS Secrets Manager to Paradime so you can reference secrets by ARN in your environment variables and connection profiles, without ever storing plaintext credentials in Paradime.

## Prerequisites

* An AWS account with AWS Secrets Manager enabled.
* Create an IAM service-account user with programmatic access (access key ID + secret access key) e.g. `paradime-ssm-access-service-account`
* An IAM role that Paradime will assume via `sts:AssumeRole` to fetch secrets.
* The IAM role must have `secretsmanager:GetSecretValue` permission on the secrets you want to reference.

## Step 1: Create an IAM role for Paradime

1. Open the **IAM Console** and create a new role, call it `ParadimeSSMAccessRole`.
2. Get the ARN of the IAM user you created that will have the programmatic access
3. Select **Custom trust policy**, call it and add a trust relationship that allows your IAM user to assume the role:

```json theme={"system"}
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "<arn of the service account user>"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}
```

3. Attach an inline policy, call it `ParadimeSSMAccessPolicy` granting access to the secrets Paradime needs:

```json theme={"system"}
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "secretsmanager:GetSecretValue",
      "Resource": [
          "<arn_1 of secrets that Paradime should have access to>",
          "<arn_2 of secrets that Paradime should have access to>"
      ]
    }
  ]
}
```

Add each individual secret you want to give Paradime access to in the Resource section.

<Info>
  Scope the `Resource` field to only the secrets Paradime needs. Avoid using `*` in production.
</Info>

## Step 2: Connect in Paradime

1. In Paradime, go to **Settings → Integrations** (see [connecting integrations](/integrations/connecting-integrations)).
2. Find **AWS Secrets Manager** under the **Secret Managers** category and click **Connect**.
3. Fill in the required fields:

| Field                 | Description                                                      |
| --------------------- | ---------------------------------------------------------------- |
| **Access Key ID**     | The IAM user's access key ID (e.g. `AKIA...`).                   |
| **Secret Access Key** | The IAM user's secret access key.                                |
| **Role ARN**          | The ARN of the IAM role created in Step 1.                       |
| **Region**            | The AWS region where your secrets are stored (e.g. `us-east-1`). |

4. Click **Test connection**. Paradime will perform an `sts:AssumeRole` call to verify the credentials work end-to-end.

## Step 3: Reference secrets

Once connected, you can use AWS Secrets Manager ARNs anywhere Paradime accepts environment variable values or connection profile fields.

### Reference format

```text theme={"system"}
arn:aws:secretsmanager:<region>:<account-id>:secret:<secret-name>
```

### Extracting a JSON key

If your secret value is a JSON object, append `#key_name` to extract a specific field:

```text theme={"system"}
arn:aws:secretsmanager:us-east-1:123456789012:secret:prod/db-AbCdEf#password
```

This resolves to the value of the `password` key inside the secret's JSON payload.

### Example: Bolt environment variable

In your Bolt schedule's environment variables, set:

| Variable             | Value                                                                                 |
| -------------------- | ------------------------------------------------------------------------------------- |
| `SNOWFLAKE_PASSWORD` | `arn:aws:secretsmanager:us-east-1:123456789012:secret:prod/snowflake-AbCdEf#password` |

Paradime resolves the ARN to the live secret value at schedule run time. The plaintext value is never stored in Paradime.

## Disconnecting

To remove the AWS Secrets Manager integration:

1. Navigate to **Settings → Integrations**.
2. Click **Disconnect** on the AWS Secrets Manager card.

<Warning>
  Any environment variables or profile fields that reference AWS ARNs will fail to resolve after disconnecting. Update them to use literal values before disconnecting.
</Warning>


## Related topics

- [Integrations](/integrations/index.md)
- [GCP Secret Manager](/integrations/gcp-secret-manager.md)
- [AWS ECS](/integrations/aws-ecs.md)
- [AWS Glue](/integrations/aws-glue.md)
- [AWS Lambda](/integrations/aws-lambda.md)