> ## Documentation Index
> Fetch the complete documentation index at: https://astronomer.io/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Set up AWS Secrets Manager as your secrets backend

This topic provides setup steps for configuring [AWS Secrets Manager](https://aws.amazon.com/secrets-manager/) as a secrets backend on Astro.

For more information about Airflow and AWS connections, see [Amazon Web Services Connection](https://airflow.apache.org/docs/apache-airflow-providers-amazon/stable/connections/aws.html).

If you use a different secrets backend tool or want to learn the general approach on how to integrate one, see [Configure a Secrets Backend](/docs/astro/secrets-backend).

## Prerequisites

* A [Deployment](/docs/astro/create-deployment).
* The [Astro CLI](/docs/cli/v1.43/overview).
* An [Astro project](/docs/cli/v1.43/develop-project#create-an-astro-project) with `apache-airflow-providers-amazon` version 5.1.0 or later. See [Add Python and OS-level packages](/docs/cli/v1.43/add-providers-packages).
* An IAM role with the `SecretsManagerReadWrite` policy that your Astro cluster can assume. See [AWS IAM roles](/docs/astro/authorize-deployments-to-your-cloud).
* (Remote Execution Only) [Helm installed](https://helm.sh/docs/intro/install/)
* (Remote Execution Only) The `values.yaml` file from the **Register Agents** modal in your **Deployments**>**Agents** page.

## Step 1: Add Airflow secrets to Secrets Manager

Create directories for Airflow variables and connections in AWS Secrets Manager that you want to store as secrets. You can use real or test values.

* When setting the secret type, choose `Other type of secret` and select the `Plaintext` option.
* If creating a connection URI or a non-dict variable as a secret, remove the brackets and quotations that are pre-populated in the plaintext field.
* The secret name is assigned after providing the plaintext value and clicking `Next`.

Secret names must correspond with the `connections_prefix` and `variables_prefix` set below in step 2. Specifically:

* If you use `"variables_prefix": "airflow/variables"`, you must set Airflow variable names as:

  ```text wrap theme={null}
  airflow/variables/<variable-key>
  ```

* The `<variable-key>` is how you will retrieve that variable's value in a dag. For example:

  ```python wrap theme={null}
  my_var = Variable.get("<variable-key>")
  ```

* If you use `"connections_prefix": "airflow/connections"`, you must set Airflow connections as:

  ```text wrap theme={null}
  airflow/connections/<connection-id>
  ```

* The `<connection-id>` is how you will retrieve that connection's URI in a dag. For example:

  ```python wrap theme={null}
  conn = BaseHook.get_connection(conn_id="<connection-id>")
  ```

* Be sure to not include a leading `/` at the beginning of your variable or connection name

For more information on adding secrets to Secrets Manager, see [AWS documentation](https://docs.aws.amazon.com/secretsmanager/latest/userguide/manage_create-basic-secret.html).

## Step 2: Set up Secrets Manager locally

<Tabs>
  <Tab title="Astro" id="astro">
    Add the following environment variables to your Astro project's `.env` file:

    ```text wrap theme={null}
    AIRFLOW__SECRETS__BACKEND=airflow.providers.amazon.aws.secrets.secrets_manager.SecretsManagerBackend
    AIRFLOW__SECRETS__BACKEND_KWARGS={"connections_prefix": "airflow/connections", "variables_prefix": "airflow/variables", "role_arn": "<your-role-arn>"}
    AWS_DEFAULT_REGION=<region>
    ```

    After you configure an Airflow connection to AWS, can run a dag locally to check that your variables are accessible using `Variable.get("<your-variable-key>")`.
  </Tab>

  <Tab title="Remote Execution" id="remote-execution">
    In your Astro project, add the [AWS Secrets Manager Backend](https://airflow.apache.org/docs/apache-airflow-providers-amazon/stable/secrets-backends/aws-secrets-manager.html) to your project by adding the following to your `values.yaml` file to set the secrets backend class to use the AWS provider and configure your secrets backend kwargs:

    ```yaml title="values.yaml" wrap theme={null}
    secretBackend: "airflow.providers.amazon.aws.secrets.secrets_manager.SecretsManagerBackend"

    commonEnv:
      - name: AIRFLOW__SECRETS__BACKEND_KWARGS
        value: '{"connections_prefix": "airflow/connections", "variables_prefix": "airflow/variables", "role_arn": "<your-role-arn>"}'
      - name: AWS_DEFAULT_REGION
        value: '<region>'
    ```

    You need to run the Remote Execution Agent with AWS credentials to fetch from your secrets manager.
  </Tab>
</Tabs>

## Step 3: Deploy environment variables to Astro

<Tabs>
  <Tab title="Astro" id="astro">
    1. Run the following commands to export your secrets backend configurations as environment variables to Astro.

       ```sh wrap theme={null}
       astro deployment variable create --deployment-id <your-deployment-id> AIRFLOW__SECRETS__BACKEND=airflow.providers.amazon.aws.secrets.secrets_manager.SecretsManagerBackend

       astro deployment variable create --deployment-id <your-deployment-id> AIRFLOW__SECRETS__BACKEND_KWARGS='{"connections_prefix": "airflow/connections", "variables_prefix": "airflow/variables",  "role_arn": "<your-role-arn>", "region_name": "<your-region>"}' --secret
       ```

    2. (Optional) Remove the environment variables from your `.env` file or store your `.env` file in a safe location to protect your credentials.

    <Info> If you delete the `.env` file, the Secrets Manager backend won't work locally. </Info>

    3. Open the Airflow UI for your Deployment and create an [Amazon Web Services connection](https://airflow.apache.org/docs/apache-airflow-providers-amazon/stable/connections/aws.html) without credentials. When you use this connection in a dag, Airflow will automatically fall back to using the credentials in your configured environment variables.
  </Tab>

  <Tab title="Remote Execution" id="remote-execution">
    1. Run the following command to update your Remote Execution Agent with your new configurations.

    ```sh wrap theme={null}
    helm upgrade astro-agent astronomer/astro-remote-execution-agent -f values.yaml
    ```
  </Tab>
</Tabs>

To further customize the Airflow and AWS SSM Parameter Store integration, see the [full list of available kwargs](https://airflow.apache.org/docs/apache-airflow-providers-amazon/stable/_api/airflow/providers/amazon/aws/secrets/systems_manager/index.html).