I started in boto3, but realised this applies to CLI as well.
I read a few questions that suggest I can set filter like this to get a secret with a Name of Production or Staging :
res = sm.list_secrets(Filters=[
{ 'Key': 'tag-key', 'Values': ['Name'] },
{ 'Key': 'tag-value', 'Values': ['Production', 'Staging'] },
])
But that seems to look for anything with a key of Name AND anything with values of Prod/Staging (in different tags) and NOT a Name=Prod/Staging.
If I create 2 Tag:Values on a secret: project:bar & Name:foo. Then try to filter for project:foo - I get that secret.
sec.list_secrets(Filters= [{ 'Key':'tag-key','Values':['project']},{ 'Key':'tag-value','Values':['foo']}])["SecretList"][0]["Tags"]
[{'Key': 'project', 'Value': 'bar'}, {'Key': 'Name', 'Value': 'foo'}]
Or if I add "something:max" and filter for Name and max :
sec.list_secrets(Filters= [{ 'Key':'tag-key','Values':['Name']},{ 'Key':'tag-value','Values':['max']}])["SecretList"][0]["Tags"]
[{'Key': 'project', 'Value': 'bar'}, {'Key': 'something', 'Value': 'max'}, {'Key': 'Name', 'Value': 'foo'}]
The same happens on the CLI, if I create a second secret to make it even more obvious. Both have a key of project and a value somewhere of max :
aws secretsmanager list-secrets --filters Key=tag-key,Values=project Key=tag-value,Values=max --query SecretList[].Tags --output text
project max
something else
project bar
something max
Name foo
So, my question is, other than a post-list loop to check for actual key:value pairs, can I make the filter only show results for tag=Value.
The usual describe-tags you have on ec2 isn't available for Secrets and tag:tagname=value doesn't work in the filter...