DevCom.AgenticRuntime.Plugin.SecretsManager 1.0.0

.NET 9.0 This package targets .NET 9.0. The package is compatible with this framework or higher. 
dotnet add package DevCom.AgenticRuntime.Plugin.SecretsManager --version 1.0.0
                    


                    

                
NuGet\Install-Package DevCom.AgenticRuntime.Plugin.SecretsManager -Version 1.0.0
This command is intended to be used within the Package Manager Console in Visual Studio, as it uses the NuGet module's version of Install-Package. 
<PackageReference Include="DevCom.AgenticRuntime.Plugin.SecretsManager" Version="1.0.0" />
For projects that support PackageReference, copy this XML node into the project file to reference the package. 
<PackageVersion Include="DevCom.AgenticRuntime.Plugin.SecretsManager" Version="1.0.0" />
                    


                            Directory.Packages.props
                        

                    

                
<PackageReference Include="DevCom.AgenticRuntime.Plugin.SecretsManager" />
                    


                            Project file
For projects that support Central Package Management (CPM), copy this XML node into the solution Directory.Packages.props file to version the package. 
paket add DevCom.AgenticRuntime.Plugin.SecretsManager --version 1.0.0
                    


                    

                
#r "nuget: DevCom.AgenticRuntime.Plugin.SecretsManager, 1.0.0"
#r directive can be used in F# Interactive and Polyglot Notebooks. Copy this into the interactive tool or source code of the script to reference the package. 
#:package DevCom.AgenticRuntime.Plugin.SecretsManager@1.0.0
#:package directive can be used in C# file-based apps starting in .NET 10 preview 4. Copy this into a .cs file before any lines of code to reference the package. 
#addin nuget:?package=DevCom.AgenticRuntime.Plugin.SecretsManager&version=1.0.0
                    


                            Install as a Cake Addin
                        

                    

                
#tool nuget:?package=DevCom.AgenticRuntime.Plugin.SecretsManager&version=1.0.0
                    


                            Install as a Cake Tool

DevCom.AgenticRuntime.Plugin.SecretsManager

AWS Secrets Manager backend for the DAP Data Protection keyring — the master keys that encrypt every credential value, provider API key, SSO client secret and MFA secret on the platform.

Changes to the keyring backend take effect only after an application restart.

What it does

  • Supplies the AWS connection configuration (Plugins page → AWS Secrets Manager → Configure). The host reads these values at bootstrap to wire the keyring.
  • Makes aws-secrets-manager selectable under Settings → Data Protection keyring while the plugin is installed and enabled.
  • Runs a health check that verifies Secrets Manager is reachable with the configured auth.

The keyring repository and its AWS client are host-owned, not part of this plugin: the keyring must not depend on an unloadable plugin. This plugin is the configuration and availability surface.

Configuration

Key Required Notes
Region yes e.g. eu-central-1
AuthMode yes iam-role (default — instance profile, ECS task role, IRSA, AWS_* env vars) or access-key
AccessKey / SecretKey with access-key stored unencrypted in plugin_config_values; prefer iam-role
KeyringSecretName no default dap/dataprotection/keyring; created on the first key write
KmsKeyId no applied only when the secret is created
ServiceUrl no LocalStack / VPC endpoint only

IAM

The principal needs secretsmanager:DescribeSecret, GetSecretValue, PutSecretValue and CreateSecret on the keyring secret, plus kms:Encrypt, kms:Decrypt and kms:GenerateDataKey on the KMS key when KmsKeyId is set.

Operational rules

  • Disabling the plugin does not switch the keyring off. It only stops the backend being selectable. The stored config keeps driving the keyring at the next boot.
  • Uninstall is refused while aws-secrets-manager is the selected or running backend — uninstalling deletes this plugin's config, which the next boot needs. Switch the keyring back to database first (see docs/runbooks/keyring-backend-cutover.md).
  • Managing this plugin (configure, enable/disable, reload, upgrade, uninstall, read config) requires platform-wide write access, the same gate as the keyring settings.
  • A green health check proves the configuration reaches Secrets Manager from the plugin. The authoritative check is the host's boot probe, logged at startup.
Product Compatible and additional computed target framework versions.
.NET net9.0 is compatible.  net9.0-android was computed.  net9.0-browser was computed.  net9.0-ios was computed.  net9.0-maccatalyst was computed.  net9.0-macos was computed.  net9.0-tvos was computed.  net9.0-windows was computed.  net10.0 was computed.  net10.0-android was computed.  net10.0-browser was computed.  net10.0-ios was computed.  net10.0-maccatalyst was computed.  net10.0-macos was computed.  net10.0-tvos was computed.  net10.0-windows was computed. 
Compatible target framework(s)
Included target framework(s) (in package)
Learn more about Target Frameworks and .NET Standard.

NuGet packages

This package is not used by any NuGet packages.

GitHub repositories

This package is not used by any popular GitHub repositories.

Version Downloads Last Updated
1.0.0 144 9/29/2026