# Create and store a token in a Secrets Manager secret
<a name="asm-create-secret"></a>

If you choose to store your access token using Secrets Manager, you can use either an existing secret connection or create a new secret. To create a new secret, do the following:

------
#### [ AWS Management Console ]

**To create a Secrets Manager secret in the AWS Management Console**

1. For **Source provider**, choose **Bitbucket**, **GitHub**, or **GitHub Enterprise**.

1. For **Credential**, do one of the following:
   + Choose **Default source credential** to use your account's default source credential to apply to all projects.

     1. If you aren't connected to your source provider, choose **Manage default source credential**.

     1. For **Credential type**, choose a credential type other than **CodeConnections**.

     1. For **Service**, choose **Secrets Manager** and for **Secrets** choose **New secret**.

     1. In **Secret name**, enter the name of your secret.

     1. In **Secret description - optional**, enter a description for your secret.

     1. Depending on the source provider you chose, enter your token or username and app password, and choose **Save**. For a Bitbucket API token, enter your Atlassian account email address and API token instead.
   + Choose **Custom source credential** to use a custom source credential to override your account's default settings.

     1. For **Credential type**, choose a credential type other than **CodeConnections**.

     1. In **Connection**, choose **Create a secret**.

     1. In **Secret name**, enter the name of your secret.

     1. In **Secret description - optional**, enter a description for your secret.

     1. Depending on the source provider you chose, enter your token or username and app password, and choose **Create**. For a Bitbucket API token, enter your Atlassian account email address and API token instead.

------
#### [ AWS CLI ]

**To create a Secrets Manager secret in the AWS CLI**
+ Open a terminal (Linux, macOS, or Unix) or command prompt (Windows). Use the AWS CLI to run the Secrets Manager **create-secret** command.

  ```
  aws secretsmanager create-secret --region {{<aws-region>}} \
              --name '{{<secret-name>}}' \
              --description '{{<secret-description>}}' \
              --secret-string '{
                  "ServerType":"{{<server-type>}}",
                  "AuthType":"{{<auth-type>}}",
                  "Token":"{{<token>}}"
                  }' \
              --tags Key=codebuild:source,Value='' \
                  Key=codebuild:source:type,Value={{<type>}} \
                  Key=codebuild:source:provider,Value={{<provider>}}
  ```

  The Secrets Manager secrets that CodeBuild accepts must be in the same account and AWS Region as the CodeBuild project and must be in the following JSON format:

  ```
  {
              "ServerType": ServerType,
              "AuthType: AuthType,
              "Token": string,
              "Username": string // Optional and is only used for Bitbucket app password or API token
          }
  ```


<table>
<thead>
  <tr><th>Field</th><th>Valid values</th><th>Description</th></tr>
</thead>
<tbody>
  <tr><td>ServerType</td><td>GITHUB<br />GITHUB_ENTERPRISE<br />BITBUCKET</td><td>The third party source provider for your Secrets Manager secret.</td></tr>
  <tr><td>AuthType</td><td>PERSONAL_ACCESS_TOKEN<br />BASIC_AUTH</td><td>The type of access token used by the credentials. For GitHub, only PERSONAL_ACCESS_TOKEN is valid. BASIC_AUTH is only valid for Bitbucket app password or API token.</td></tr>
  <tr><td>Token</td><td>{{string}}</td><td>For GitHub or GitHub Enterprise, this is the personal access token. For Bitbucket, this is the access token, the Bitbucket app password, or the Bitbucket API token.</td></tr>
  <tr><td>Username</td><td>{{string}}</td><td>The Bitbucket username when the AuthType is BASIC_AUTH. If you use a Bitbucket API token, this is the email address associated with your Atlassian account. This parameter is not valid for other types of source providers.</td></tr>
</tbody>
</table>


  Additionally, CodeBuild uses the following resource tags on the secret to ensure the secrets are easily selectable when creating or editing projects.


<table>
<thead>
  <tr><th>Tag key</th><th>Tag value</th><th>Description</th></tr>
</thead>
<tbody>
  <tr><td>codebuild:source:provider</td><td>github<br />github_enterprise<br />bitbucket</td><td>Tells CodeBuild which provider this secret is intended for.</td></tr>
  <tr><td>codebuild:source:type</td><td>personal_access_token<br />basic_auth</td><td>Tells CodeBuild the type of access token in this secret.</td></tr>
</tbody>
</table>


------