Skip to main content
Connect your AWS account to pull centrally managed secrets into the Vault. AWS secrets share the same {{vault:key}} namespace as local secrets, so your requests don’t need to know where a secret comes from.
Availability: External secret providers, including AWS Secrets Manager, require the desktop app, a signed-in Cloud project, and an eligible plan, and are rolling out gradually. If you don’t see the option to add a provider, update to the latest version or contact support. Local vault remains fully functional without signing in.

​
Setting up an AWS provider

1

Open the Vault page

Click Vault in the app footer.
2

Connect a provider

Click Connect provider below the Local Secrets section.
3

Enter AWS credentials

Fill in the configuration form:
4

Test the connection

Click Test connection to validate your credentials against AWS. You can still save even if the test fails and fix credentials later.
5

Save

Click Add provider. The AWS Secrets Manager section appears on the Vault page.

​
Required AWS IAM permissions

Your IAM user or role needs the following permissions:
Scope the Resource to specific secret ARNs for least-privilege access instead of using *.

​
Adding and fetching secrets

1

Add a secret mapping

In the AWS Secrets Manager section, click Add secret. Enter:
  • Alias: the key you’ll use in {{vault:alias}}
  • Secret Name or ARN: the AWS secret identifier
  • Mode: Plaintext or JSON
2

Fetch the secret

Click Fetch secrets to pull the values. Requestly calls the AWS GetSecretValue API and stores the result encrypted locally.
3

Use it in a request

Reference the secret using {{vault:alias}} in any request field. It resolves on send just like a local secret.

​
JSON secrets

When an AWS secret contains a JSON object, Requestly auto-expands it into dot-separated keys:
This creates three vault entries:
  • {{vault:dbCredentials.username}} resolves to admin
  • {{vault:dbCredentials.password}} resolves to s3cret
  • {{vault:dbCredentials.host}} resolves to db.example.com
Nested JSON objects expand recursively with dot notation.

​
Refreshing secrets after rotation

Fetched values are cached locally and survive app restarts. Requestly also re-fetches every secret of the active configuration automatically when the app starts, so a secret rotated in AWS overnight is usually current before you send your first request. While that startup fetch runs, the Secret Provider section shows a “Loading secrets from provider at startup” banner. If the startup fetch fails, a warning banner names the affected configuration and offers a Fetch secrets button to retry. You can click Fetch secrets at any time to pull the current values for every row in the section. The Last fetched label next to the configuration selector helps you judge staleness.
There is no scheduled refresh. Fetching always refreshes the whole section, not a single row.

​
Multiple AWS configurations

You can store multiple AWS configurations (e.g., Production, Staging, EU region) and switch between them:
  1. Click the config selector in the AWS section header
  2. Select a different configuration. The secrets table swaps to that config’s secrets.
  3. {{vault:key}} references resolve from the active configuration only
Each configuration maintains its own independent set of secrets and cached values. Switching configs preserves all caches, so no re-fetching is needed. To add a new configuration, select + Add new configuration from the config selector dropdown.

​
Credential errors

When AWS credentials expire or become invalid:
  • The affected secret row shows an error message
  • The provider config section shows an error indicator
  • The failed secret’s cached value is cleared from disk and memory, so {{vault:alias}} stops resolving until a fetch succeeds. Only the rows that failed are affected.
To fix: edit your credentials in the same provider config form (no separate reauthentication flow), save, and retry the fetch.

​
Move to local

You can convert any AWS secret to a local vault secret:
  1. Select Move to local on an AWS secret
  2. The secret moves to the Local Secrets section with the last fetched value preserved
  3. It becomes fully editable and is no longer linked to AWS

​
FAQ

You can store multiple AWS configurations, but only one is active at a time. The active config’s secrets are the ones that resolve via {{vault:key}}. Switch between configs using the config selector in the AWS section header.
No. Fetched values are cached locally and persist until you refresh them. Click Fetch secrets to pull the latest values from AWS.
No. rq.vault is read-only from scripts. Only rq.vault.get(), rq.vault.has(), and rq.vault.toObject() are available. Manage AWS secrets from the Vault page or in AWS directly.