Repository: external-secrets/external-secrets (Go)

Issue:
[Question] AWS SecretsManager Push Whole Secret
Is pushing an entire secret to AWS Secrets Manager supported? I'm currently on version 0.9.17 and using the following configuration:

```apiVersion: external-secrets.io/v1alpha1
kind: PushSecret
metadata:
  name: aws-sync
  namespace: my-namespace
spec:
  deletionPolicy: Delete
  secretStoreRefs: 
    - name: aws
      kind: ClusterSecretStore
  selector:
    secret:
      name: foo
  data:
    - match:
        remoteRef:
          remoteKey: foo
```

I'm getting this error:

```set secret failed: could not write remote ref to target secretstore aws: pushing the whole secret is not yet implemented```

Is there a version where this has been implemented?


Discussion:
Hello!

Yes, currently, it's not implemented.

```go
func (sm *SecretsManager) PushSecret(ctx context.Context, secret *corev1.Secret, psd esv1beta1.PushSecretData) error {
	if psd.GetSecretKey() == "" {
		return errors.New("pushing the whole secret is not yet implemented")
	}

```

Provider features are community driven. If there is a need for it, anyone can take a stab at trying to implement it.

If you don't want to, or can't for some reason, the maintainers will maybe eventually get to it, but there is no guarantee. The priority is based on user engagement.
Ok, I'll open a feature request for this. Appreciate the quick response and code snippet.
@eternalyperplxed please reference the feature request, I have some capacity to work on this.
The "feature request" is this issues technically. :) There is nothing else.
using v0.14.3, also needs this feature.

@Skarlso Since this is not implemented, I think it is better to fix the doc here: https://external-secrets.io/main/guides/pushsecrets/#2-by-leaving-off-the-secret-key-but-setting-the-remote-property-option

![Image](https://github.com/user-attachments/assets/a2e1e550-3c95-4268-97ce-adbd53c4df45)

I'll see what I can do about it. 
Should be done now. With next release. :) 



Patch:
diff --git a/pkg/provider/aws/secretsmanager/secretsmanager.go b/pkg/provider/aws/secretsmanager/secretsmanager.go
index 4113e42e45e..2c85be2e733 100644
--- a/pkg/provider/aws/secretsmanager/secretsmanager.go
+++ b/pkg/provider/aws/secretsmanager/secretsmanager.go
@@ -193,12 +193,12 @@ func (sm *SecretsManager) handleSecretError(err error) (bool, error) {
 }
 
 func (sm *SecretsManager) PushSecret(ctx context.Context, secret *corev1.Secret, psd esv1beta1.PushSecretData) error {
-	if psd.GetSecretKey() == "" {
-		return errors.New("pushing the whole secret is not yet implemented")
+	value, err := utils.ExtractSecretData(psd, secret)
+	if err != nil {
+		return fmt.Errorf("failed to extract secret data: %w", err)
 	}
 
 	secretName := psd.GetRemoteKey()
-	value := secret.Data[psd.GetSecretKey()]
 	secretValue := awssm.GetSecretValueInput{
 		SecretId: &secretName,
 	}


Test patch:
diff --git a/pkg/provider/aws/secretsmanager/secretsmanager_test.go b/pkg/provider/aws/secretsmanager/secretsmanager_test.go
index 115a7dfd318..0652eb11e0d 100644
--- a/pkg/provider/aws/secretsmanager/secretsmanager_test.go
+++ b/pkg/provider/aws/secretsmanager/secretsmanager_test.go
@@ -466,6 +466,7 @@ func TestSetSecret(t *testing.T) {
 	}
 
 	pushSecretDataWithoutProperty := fake.PushSecretData{SecretKey: secretKey, RemoteKey: fakeKey, Property: ""}
+	pushSecretDataWithoutSecretKey := fake.PushSecretData{RemoteKey: fakeKey, Property: ""}
 	pushSecretDataWithMetadata := fake.PushSecretData{SecretKey: secretKey, RemoteKey: fakeKey, Property: "", Metadata: &apiextensionsv1.JSON{
 		Raw: []byte(`{"secretPushFormat": "string"}`),
 	}}
@@ -501,6 +502,22 @@ func TestSetSecret(t *testing.T) {
 				err: nil,
 			},
 		},
+		"SetSecretSucceedsWithoutSecretKey": {
+			reason: "a secret can be pushed to aws secrets manager without secret key",
+			args: args{
+				store: makeValidSecretStore().Spec.Provider.AWS,
+				client: fakesm.Client{
+					GetSecretValueWithContextFn: fakesm.NewGetSecretValueWithContextFn(secretValueOutput, nil),
+					CreateSecretWithContextFn:   fakesm.NewCreateSecretWithContextFn(secretOutput, nil),
+					PutSecretValueWithContextFn: fakesm.NewPutSecretValueWithContextFn(putSecretOutput, nil),
+					DescribeSecretWithContextFn: fakesm.NewDescribeSecretWithContextFn(tagSecretOutput, nil),
+				},
+				pushSecretData: pushSecretDataWithoutSecretKey,
+			},
+			want: want{
+				err: nil,
+			},
+		},
 		"SetSecretSucceedsWithExistingSecretAndStringFormat": {
 			reason: "a secret can be pushed to aws secrets manager when it already exists",
 			args: args{