AtfSecretsManager

AtfSecretsManager creates secrets. Only the secret ARN reaches SSM (secrets/{baseName}/secretArn) — the secret value is never written to a parameter or a synthesised template. Consumers resolve the value at runtime from the ARN.

When to reach for it

Use it for runtime secrets (webhook URLs, third-party keys). See Storage & Encryption.

Composition

Composed by DataStack (DATA_STACK_IDS.secrets).

Props & API

AtfSecretsManager extends its CDK counterpart, and its props extend Omit<CdkProps> — every CDK prop the framework doesn’t own is available directly, with full autocomplete. The complete, always-current prop interface is generated from the source in the API reference. See also Axis IS CDK for the extend-never-wrap contract.