diff --git a/moto/secretsmanager/models.py b/moto/secretsmanager/models.py index 0aaa2027a..5542cb3e3 100644 --- a/moto/secretsmanager/models.py +++ b/moto/secretsmanager/models.py @@ -578,6 +578,20 @@ class SecretsManagerBackend(BaseBackend): return secret_id + def untag_resource(self, secret_id, tag_keys): + + if secret_id not in self.secrets.keys(): + raise SecretNotFoundException() + + secret = self.secrets[secret_id] + tags = secret.tags + + for tag in tags: + if tag["Key"] in tag_keys: + tags.remove(tag) + + return secret_id + @staticmethod def get_resource_policy(secret_id): resource_policy = { diff --git a/moto/secretsmanager/responses.py b/moto/secretsmanager/responses.py index e1c0517db..a469f5baa 100644 --- a/moto/secretsmanager/responses.py +++ b/moto/secretsmanager/responses.py @@ -162,3 +162,10 @@ class SecretsManagerResponse(BaseResponse): secret_id = self._get_param("SecretId") tags = self._get_param("Tags", if_none=[]) return secretsmanager_backends[self.region].tag_resource(secret_id, tags) + + def untag_resource(self): + secret_id = self._get_param("SecretId") + tag_keys = self._get_param("TagKeys", if_none=[]) + return secretsmanager_backends[self.region].untag_resource( + secret_id=secret_id, tag_keys=tag_keys + ) diff --git a/tests/test_secretsmanager/test_secretsmanager.py b/tests/test_secretsmanager/test_secretsmanager.py index 539b878f9..1e3515709 100644 --- a/tests/test_secretsmanager/test_secretsmanager.py +++ b/tests/test_secretsmanager/test_secretsmanager.py @@ -950,6 +950,35 @@ def test_tag_resource(): ) +@mock_secretsmanager +def test_untag_resource(): + conn = boto3.client("secretsmanager", region_name="us-west-2") + conn.create_secret(Name="test-secret", SecretString="foosecret") + conn.tag_resource( + SecretId="test-secret", + Tags=[ + {"Key": "FirstTag", "Value": "SomeValue"}, + {"Key": "SecondTag", "Value": "SomeValue"}, + ], + ) + + conn.untag_resource(SecretId="test-secret", TagKeys=["FirstTag"]) + secrets = conn.list_secrets() + assert secrets["SecretList"][0].get("Tags") == [ + {"Key": "SecondTag", "Value": "SomeValue"}, + ] + + with pytest.raises(ClientError) as cm: + conn.untag_resource( + SecretId="dummy-test-secret", TagKeys=["FirstTag"], + ) + + assert ( + "Secrets Manager can't find the specified secret." + == cm.value.response["Error"]["Message"] + ) + + @mock_secretsmanager def test_secret_versions_to_stages_attribute_discrepancy(): client = boto3.client("secretsmanager", region_name="us-west-2")