stratumctl secrets
Customer Secrets Manager
stratumctl secrets [flags]Subcommands
Section titled “Subcommands”stratumctl secrets create: Create a secret (metadata; put a value next with put-value)stratumctl secrets delete: Schedule a secret for deletion (soft; restore inside the window)stratumctl secrets delete-version: Delete an unlabeled version (ciphertext first, then the row)stratumctl secrets get: Describe a secret (never its value; see get-value)stratumctl secrets get-value: Print a secret’s value (only the value, so it composes)stratumctl secrets list: List a project’s secrets (metadata only)stratumctl secrets put-value: Store a new version of a secret’s value (from –file or stdin, never an argument)stratumctl secrets restore: Cancel a pending deletion inside the recovery windowstratumctl secrets rotate: Rotate now (the reconciler runs it on its next pass; check with rotation get)stratumctl secrets rotation: Manage a secret’s rotation schedule (built-in rotators,)stratumctl secrets stage: Move or remove a stage label (UpdateSecretVersionStage)stratumctl secrets update: Update a secret’s description, recovery window or tagsstratumctl secrets versions: List a secret’s versions, newest first (metadata only)
stratumctl secrets create
Section titled “stratumctl secrets create”Create a secret (metadata; put a value next with put-value)
stratumctl secrets create <name> [flags]Examples
Section titled “Examples”stratumctl secrets create prod/db/password --description "Postgres primary" --recovery-window-days 7 --tag env=prod| Flag | Type | Default | Description |
|---|---|---|---|
--description |
string | Description | |
--project |
string | Project ID (defaults to STRATUM_PROJECT or profile project_id) | |
--recovery-window-days |
int | 0 |
Default recovery window for a later delete (7-30; server default 30) |
--region |
string | Region (defaults to the install’s) | |
--tag |
stringArray | Tag key=value (repeatable) |
stratumctl secrets delete
Section titled “stratumctl secrets delete”Schedule a secret for deletion (soft; restore inside the window)
stratumctl secrets delete <secret-id> [flags]Examples
Section titled “Examples”stratumctl secrets delete s-4k8m2x7q9a --recovery-window-days 7stratumctl secrets delete s-4k8m2x7q9a --force| Flag | Type | Default | Description |
|---|---|---|---|
--force |
bool | false |
Purge now, skipping the recovery window (needs secrets:ForceDeleteSecret) |
--project |
string | Project ID (defaults to STRATUM_PROJECT or profile project_id) | |
--recovery-window-days |
int | 0 |
Recovery window for this delete (7-30; default: the secret’s own) |
stratumctl secrets delete-version
Section titled “stratumctl secrets delete-version”Delete an unlabeled version (ciphertext first, then the row)
stratumctl secrets delete-version <secret-id> <version-id> [flags]Examples
Section titled “Examples”stratumctl secrets delete-version s-4k8m2x7q9a sv-8k2m4x7q9a| Flag | Type | Default | Description |
|---|---|---|---|
--project |
string | Project ID (defaults to STRATUM_PROJECT or profile project_id) |
stratumctl secrets get
Section titled “stratumctl secrets get”Describe a secret (never its value; see get-value)
stratumctl secrets get <secret-id> [flags]Examples
Section titled “Examples”stratumctl secrets get s-4k8m2x7q9astratumctl secrets get s-4k8m2x7q9a --output json| Flag | Type | Default | Description |
|---|---|---|---|
--project |
string | Project ID (defaults to STRATUM_PROJECT or profile project_id) |
stratumctl secrets get-value
Section titled “stratumctl secrets get-value”Print a secret’s value (only the value, so it composes)
stratumctl secrets get-value <secret-id> [flags]Prints the plaintext value and nothing else on stdout (a trailing newline is added only when stdout is a terminal). With –output json the full GetSecretValue response is printed. Every call is audited server-side.
Examples
Section titled “Examples”stratumctl secrets get-value s-4k8m2x7q9astratumctl secrets get-value s-4k8m2x7q9a --stage PREVIOUS| Flag | Type | Default | Description |
|---|---|---|---|
--project |
string | Project ID (defaults to STRATUM_PROJECT or profile project_id) | |
--stage |
string | Stage label (default CURRENT) | |
--version-id |
string | Specific version id |
stratumctl secrets list
Section titled “stratumctl secrets list”List a project’s secrets (metadata only)
stratumctl secrets list [flags]Examples
Section titled “Examples”stratumctl secrets liststratumctl secrets list --limit 50 --output json| Flag | Type | Default | Description |
|---|---|---|---|
--limit |
int | 0 |
Page size (server default 100, max 500); setting it (or –page-token) returns one page and prints the next token instead of listing everything |
--page-token |
string | Cursor from a previous page; returns that one page | |
--project |
string | Project ID (defaults to STRATUM_PROJECT or profile project_id) |
stratumctl secrets put-value
Section titled “stratumctl secrets put-value”Store a new version of a secret’s value (from –file or stdin, never an argument)
stratumctl secrets put-value <secret-id> [flags]Reads the value from –file, or from stdin when –file is “-” or omitted, so the value never appears in shell history or a process listing. The new version becomes CURRENT (or PENDING with –stage PENDING).
Examples
Section titled “Examples”printf '%s' "$PASS" | stratumctl secrets put-value s-4k8m2x7q9astratumctl secrets put-value s-4k8m2x7q9a --file./credentials.json --kind key_value_json| Flag | Type | Default | Description |
|---|---|---|---|
--file |
string | File holding the value (“-” or omitted = stdin) | |
--kind |
string | Value kind: string (default) or key_value_json | |
--project |
string | Project ID (defaults to STRATUM_PROJECT or profile project_id) | |
--stage |
string | Stage for the new version: CURRENT (default) or PENDING |
stratumctl secrets restore
Section titled “stratumctl secrets restore”Cancel a pending deletion inside the recovery window
stratumctl secrets restore <secret-id> [flags]Examples
Section titled “Examples”stratumctl secrets restore s-4k8m2x7q9a| Flag | Type | Default | Description |
|---|---|---|---|
--project |
string | Project ID (defaults to STRATUM_PROJECT or profile project_id) |
stratumctl secrets rotate
Section titled “stratumctl secrets rotate”Rotate now (the reconciler runs it on its next pass; check with rotation get)
stratumctl secrets rotate <secret-id> [flags]Examples
Section titled “Examples”stratumctl secrets rotate s-4k8m2x7q9a| Flag | Type | Default | Description |
|---|---|---|---|
--project |
string | Project ID (defaults to STRATUM_PROJECT or profile project_id) |
stratumctl secrets rotation
Section titled “stratumctl secrets rotation”Manage a secret’s rotation schedule (built-in rotators,)
stratumctl secrets rotation [flags]Subcommands
Section titled “Subcommands”stratumctl secrets rotation clear: Remove the rotation schedule (an in-flight rotation completes)stratumctl secrets rotation get: Show a secret’s rotation schedule and last resultstratumctl secrets rotation set: Create or replace the rotation schedule
stratumctl secrets rotation clear
Section titled “stratumctl secrets rotation clear”Remove the rotation schedule (an in-flight rotation completes)
stratumctl secrets rotation clear <secret-id> [flags]Examples
Section titled “Examples”stratumctl secrets rotation clear s-4k8m2x7q9a| Flag | Type | Default | Description |
|---|---|---|---|
--project |
string | Project ID (defaults to STRATUM_PROJECT or profile project_id) |
stratumctl secrets rotation get
Section titled “stratumctl secrets rotation get”Show a secret’s rotation schedule and last result
stratumctl secrets rotation get <secret-id> [flags]Examples
Section titled “Examples”stratumctl secrets rotation get s-4k8m2x7q9astratumctl secrets rotation get s-4k8m2x7q9a --output json| Flag | Type | Default | Description |
|---|---|---|---|
--project |
string | Project ID (defaults to STRATUM_PROJECT or profile project_id) |
stratumctl secrets rotation set
Section titled “stratumctl secrets rotation set”Create or replace the rotation schedule
stratumctl secrets rotation set <secret-id> [flags]–type names a built-in rotator (iam_access_key, s3_access_key); –target is the credential owner it acts on (a service account id or ARN for iam_access_key) and must belong to the secret’s project; –cron is a 5-field cron.
Examples
Section titled “Examples”stratumctl secrets rotation set s-4k8m2x7q9a --type iam_access_key --target sa-7k2m9x4q8a --cron "0 3 1 * *" --window-hours 24stratumctl secrets rotation set s-4k8m2x7q9a --type db_master --target db-3k8m2x7q9a --cron "0 3 * * 0"| Flag | Type | Default | Description |
|---|---|---|---|
--cron |
string | 5-field cron, e.g. “0 3 1 * *” | |
--disabled |
bool | false |
Create the schedule disabled |
--project |
string | Project ID (defaults to STRATUM_PROJECT or profile project_id) | |
--target |
string | Credential owner (service account id/ARN for iam_access_key; the db instance id for db_master) | |
--type |
string | Rotator: iam_access_key | s3_access_key | db_master | |
--window-hours |
int | 0 |
Hours the previous credential stays valid after a promote (1-168; default 6) |
stratumctl secrets stage
Section titled “stratumctl secrets stage”Move or remove a stage label (UpdateSecretVersionStage)
stratumctl secrets stage <secret-id> [flags]–move-to <version> moves –label onto that version; with –remove-from the move is guarded (that version must hold the label). –remove-from alone removes a custom label. Moving CURRENT gives the displaced version PREVIOUS — the rotation promote step.
Examples
Section titled “Examples”stratumctl secrets stage s-4k8m2x7q9a --label CURRENT --move-to sv-8k2m4x7q9a --remove-from sv-5k8m2x7q9a| Flag | Type | Default | Description |
|---|---|---|---|
--label |
string | Stage label (CURRENT, PENDING, PREVIOUS or custom) | |
--move-to |
string | Version id to move the label onto | |
--project |
string | Project ID (defaults to STRATUM_PROJECT or profile project_id) | |
--remove-from |
string | Version id the label must currently be on (guard), or to remove a custom label from |
stratumctl secrets update
Section titled “stratumctl secrets update”Update a secret’s description, recovery window or tags
stratumctl secrets update <secret-id> [flags]Examples
Section titled “Examples”stratumctl secrets update s-4k8m2x7q9a --description "Postgres primary (prod)"stratumctl secrets update s-4k8m2x7q9a --tag env=prod --tag team=a| Flag | Type | Default | Description |
|---|---|---|---|
--clear-tags |
bool | false |
Remove every tag |
--description |
string | New description (pass an empty string to clear) | |
--project |
string | Project ID (defaults to STRATUM_PROJECT or profile project_id) | |
--recovery-window-days |
int | 0 |
New default recovery window (7-30) |
--tag |
stringArray | Replace the tag set with these key=value pairs (repeatable) |
stratumctl secrets versions
Section titled “stratumctl secrets versions”List a secret’s versions, newest first (metadata only)
stratumctl secrets versions <secret-id> [flags]Examples
Section titled “Examples”stratumctl secrets versions s-4k8m2x7q9astratumctl secrets versions s-4k8m2x7q9a --output json| Flag | Type | Default | Description |
|---|---|---|---|
--limit |
int | 0 |
Page size; setting it (or –page-token) returns one page and prints the next token instead of listing everything |
--page-token |
string | Cursor from a previous page; returns that one page | |
--project |
string | Project ID (defaults to STRATUM_PROJECT or profile project_id) |