Add GetSecretLabels

secrets/aws.go

@@ -65,6 +65,26 @@ func (a *awsSecretsManager) CheckSecretExists(ctx context.Context, key string) b
 	return err == nil
 }
 
+func (a *awsSecretsManager) GetSecretLabels(ctx context.Context, key string) (map[string]string, bool) {
+	secret, err := a.client.DescribeSecret(ctx, &secretsmanager.DescribeSecretInput{
+		SecretId: &key,
+	})
+	if err != nil {
+		return nil, false
+	}
+	return convert(secret), true
+}
+
+func convert(secret *secretsmanager.DescribeSecretOutput) map[string]string {
+	labels := make(map[string]string)
+	for _, tag := range secret.Tags {
+		if tag.Key != nil && tag.Value != nil {
+			labels[*tag.Key] = *tag.Value
+		}
+	}
+	return labels
+}
+
 func (a *awsSecretsManager) CreateSecret(ctx context.Context, key string, value string, tags map[string]string) error {
 	mergedTags := a.mergeTags(tags)
 

secrets/az.go

@@ -74,6 +74,29 @@ func (a *azSecretsManager) CheckSecretExists(ctx context.Context, key string) bo
 	return err == nil && len(page.Value) > 0
 }
 
+func (a *azSecretsManager) GetSecretLabels(ctx context.Context, key string) (map[string]string, bool) {
+	key = sanitize(key)
+	pager := a.client.NewListSecretVersionsPager(key, nil)
+	if !pager.More() {
+		return nil, false
+	}
+
+	page, err := pager.NextPage(ctx)
+	if err != nil || len(page.Value) == 0 {
+		return nil, false
+	}
+
+	// Get the latest version's properties (first item should be the latest)
+	secretProps := page.Value[0]
+	labels := make(map[string]string)
+	for k, v := range secretProps.Tags {
+		if v != nil {
+			labels[k] = *v
+		}
+	}
+	return labels, true
+}
+
 // CreateSecret creates a new secret.
 func (a *azSecretsManager) CreateSecret(ctx context.Context, key string, value string, tags map[string]string) error {
 	key = sanitize(key)

secrets/gcp.go

@@ -124,6 +124,16 @@ func (g *gcpSecretsManager) CheckSecretExists(ctx context.Context, key string) b
 	return err == nil
 }
 
+func (g *gcpSecretsManager) GetSecretLabels(ctx context.Context, key string) (map[string]string, bool) {
+	secret, err := g.client.GetSecret(ctx, &secretmanagerpb.GetSecretRequest{
+		Name: g.getSecretID(key),
+	})
+	if err != nil {
+		return nil, false
+	}
+	return secret.Labels, true
+}
+
 func (g *gcpSecretsManager) CreateSecret(ctx context.Context, key string, value string, tags map[string]string) error {
 	secretID := g.getSecretID(key)
 	mergedTags := g.mergeTags(tags)

secrets/generic.go

@@ -28,6 +28,8 @@ import (
 type SecretAPI interface {
 	GetSecretValue(ctx context.Context, key string) (string, bool)
 	CheckSecretExists(ctx context.Context, key string) bool
+	// GetSecretLabels gets the secret labels.
+	GetSecretLabels(context.Context, string) (map[string]string, bool)
 	// CreateSecret creates a new secret with the provided tags.
 	// Global tags will overwrite any provided tags with the same keys.
 	CreateSecret(ctx context.Context, key string, value string, tags map[string]string) error
@@ -75,6 +77,16 @@ func (s *secretProvider) CheckSecretExists(ctx context.Context, key string) bool
 	return s.SecretAPI.CheckSecretExists(ctx, secretName)
 }
 
+// GetSecretLabels gets the secret labels.
+func (s *secretProvider) GetSecretLabels(ctx context.Context, key string) (map[string]string, bool) {
+	secretName, _, ok := s.trimPrefixAndSplit(key)
+	if !ok {
+		return nil, false
+	}
+
+	return s.SecretAPI.GetSecretLabels(ctx, secretName)
+}
+
 // CreateSecret creates a new secret.
 func (s *secretProvider) CreateSecret(ctx context.Context, key string, value string, tags map[string]string) error {
 	secretName, _, ok := s.trimPrefixAndSplit(key)

secrets/generic_test.go

@@ -132,6 +132,11 @@ func (f *fakeSecretManager) CheckSecretExists(_ context.Context, key string) boo
 	return ok
 }
 
+func (f *fakeSecretManager) GetSecretLabels(_ context.Context, key string) (map[string]string, bool) {
+	_, ok := f.secrets[key]
+	return map[string]string{}, ok
+}
+
 func (f *fakeSecretManager) CreateSecret(_ context.Context, key string, value string, tags map[string]string) error {
 	if f.secrets == nil {
 		f.secrets = make(map[string]string)
@@ -423,6 +428,11 @@ func (f *fakeSecretManagerWithGlobalTags) CheckSecretExists(_ context.Context, k
 	return ok
 }
 
+func (f *fakeSecretManagerWithGlobalTags) GetSecretLabels(_ context.Context, key string) (map[string]string, bool) {
+	_, ok := f.secrets[key]
+	return map[string]string{}, ok
+}
+
 func (f *fakeSecretManagerWithGlobalTags) CreateSecret(_ context.Context, key string, value string, tags map[string]string) error {
 	if f.secrets == nil {
 		f.secrets = make(map[string]string)