Delete Terraform resource aws_secretsmanager_secret_version does not delete Secrets Manager secret entry

Question

I created an AWS secrets manager and a secret key-value entry using Terraform as below. However, After I comment out below aws_secretsmanager_secret_version resource and terraform apply, terraform shows it deletes the secret key-value entry, but I can still see the entry in AWS console and I can still use CLI to get the secret key-value using aws secretsmanager get-secret-value --secret-id myTestName.

Is this entry really deleted? Why I still see it in AWS console? or maybe it is deleted but the one shown in console and cli is an old version? at least Terraform deleted it from its state file.

resource "aws_secretsmanager_secret" "test" {
  name = "myTestName"
}
# I deleted secret key-value entry by 
# commenting out below and apply terraform again
resource "aws_secretsmanager_secret_version" "test" {
  secret_id     = aws_secretsmanager_secret.test.id
  secret_string = <<EOF
   {
    "test-key": "test-value"
   }
EOF
}

Answer 1

According to AWS documentation:

...Secrets Manager does not immediately delete secrets. Instead, Secrets Manager immediately makes the secrets inaccessible and scheduled for deletion after a recovery window of a minimum of seven days...

Due to critical nature of the secrets, this functionality is there for a reason - to prevent you from accidentally deleting important production-grade secret, which would cause serious problems with accessing services.

If you still want to delete a secret, you can do it with force:

aws secretsmanager delete-secret --secret-id your-secret --force-delete-without-recovery --region your-region

You may need to delete it with force if you want to immediately create new secret with the same name, to avoid name conflict.

Update: As you clarified, for you specific case - where you wish to delete the version of the secret, it cannot be done while you have only one version of the secret with the AWSCURRENT label:

aws secretsmanager get-secret-value --secret-id myTestName
...
"Name": "myTestName",  
"SecretString": " ...
    "VersionStages": [
        "AWSCURRENT"
    ]
...

From the terraform documentation:

If the AWSCURRENT staging label is present on this version during resource deletion, that label cannot be removed and will be skipped to prevent errors when fully deleting the secret. That label will leave this secret version active even after the resource is deleted from Terraform unless the secret itself is deleted. Move the AWSCURRENT staging label before or after deleting this resource from Terraform to fully trigger version deprecation if necessary.