Merge branch 'master' of github.e.it.census.gov:terraform/cloud-infor…

…mation

aws/documentation/naming-tagging-standard/naming/README.md

@@ -2,12 +2,13 @@
 
 * Host Naming (in need of some modernization)
   * [TCO Wiki](https://wiki.apps.tco.census.gov/index.php/Networking#Host_Naming)
-* [S3](s3.md)
 * [IAM](iam.md)
   * [IAM Users](iam.md#iam-users)
   * [IAM Groups](iam.md#iam-groups)
   * [IAM Roles](iam.md#iam-roles)
   * [IAM Policies](iam.md#iam-policies)
+* [S3](s3.md)
+* [SecretsManager](secretsmanager.md)
 
 # CHANGELOG
 
@@ -16,3 +17,6 @@
 
 - 1.0.1 -- 2025-03-04
   - add host naming
+
+- 1.0.2 -- 2026-03-31
+  - add secretsmanager

aws/documentation/naming-tagging-standard/naming/secretsmanager.md

@@ -0,0 +1,94 @@
+# NTS | SecretsManager 
+
+This document comes primarily from [Organization Shared Secrets and Parameters](https://github.e.it.census.gov/terraform/cloud-information/tree/master/aws/documentation/organizations/shared-secrets-parameters).
+
+It describe the formats of the SecretsManager Secret name.
+
+# Naming
+
+The secretsmanager secret naming will follow this structure.  Note by default, we choose not to include the region name in the secret (or SSM
+paramater) name.  This simplifies the use where the region is not specified.  If a secret needs to represent multiple region details (i.e.,
+data for multiple regions in a secret available to multiple regions), it is recommended to include that within the JSON object of the
+secret.  However, the region may be used within the name if a use case can be argued where it is necessary.
+
+## Naming: Enterprise Use
+
+For deployment to all accounts, defined from the organziation management account, or from the service account within the
+core accounts.  These are approved for user by the cloud architect before implementation. They will be listed [here](#secrets--enterprise)
+as well as documented under [secrets](secrets/).
+
+Format: `/enterprise/{category}/{purpose}/[{region}/]{item}`
+
+* segments will be all in lowercase, consist of the set including letters, digits, and underscore (a-z, 0-9, _)  
+* {category}  
+  * broad collection of what the secrets apply towards  
+  * examples include:  
+    * terraform: used to distribute settings for Terraform use, though not exclusively  
+* {purpose}  
+  * more specific smaller collection by which to bundle the secret
+  * examples include:  
+    * providers: used with _category_ = `terraform` to identify a set of secrets used for Terraform providers
+* {region}  
+  * optional, corresponds to the canonical region name  
+  * use of this structure should be rare and generally unneccessary  
+  * examples include:  
+    * us-east-1  
+    * us-gov-west-1  
+* {item}  
+  * specific item for which this secret is used  
+
+## Naming: Local Use
+
+This is not intended to be usable across all accounts, only within the account where it is defined.  With such a secret, access to the
+organziation (or other OUs) will not be enabled.  This _may_ be used to override an **Enterprise** secret (logic to be defined by the user, but
+somethign like "look for /local/X by name, if not found, use /enterprise/X").
+
+Format: `/local/{category}/{purpose}/[{region}/]{item}`
+
+The same format rules apply as for `/enterprise` above.
+
+## Naming: Application Specific Use
+
+This is how application areas will construct SecretsManager secret names.
+It uses components of the base label format, and includes the organization or program, project, and environment.
+
+Format: `/app/{organization_program}/{project}/[{environment}/][{region}/]{item}`
+
+The same format rules apply as for `/enterprise` above for the relevant field names.
+
+* {organization_program}  
+  * the organziation abbreviate or the program name  
+  * examples include:  
+    * adsd (organization)  
+    * ditd (organization)  
+    * dice (program)  
+    * edl (program)  
+* {project}  
+  * the project under the _organization_program_, specific to the org/program  
+  * examples include:  
+    * mojo, centurion (for dice)  
+    * dapps chec (for adsd)  
+* {environment}  
+  * optional, if per-environment separation is needed (for a secret, it probably is)  
+  * if defined, one of the defined environments:  
+    * common  
+    * services  
+    * shared  
+    * dev  
+    * test  
+    * ite  
+    * qa  
+    * uat  
+    * stage  
+    * prod  
+
+# Links
+
+* [Base Label Format](../README.md#base-label-format)
+
+# CHANGELOG
+
+- 1.0.0 -- 2026-03-31
+  - initial
+
+