> For the complete documentation index, see [llms.txt](https://docs.keeper.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.keeper.io/keeperpam/secrets-manager/secrets-manager-command-line-interface/sync-command.md).

# Sync Command

{% hint style="info" %}
Sync is one-way. The CLI reads from Keeper Vault and writes to the external secrets manager.
{% endhint %}

## `sync` command

**Description:** Sync secrets from Keeper Vault to an external secrets manager.

`ksm sync --credentials <UID> --type [aws|azure|gcp|json] [--dry-run] [--preserve-missing] --map <KEY NOTATION>...`

{% hint style="info" %}
Requires a Secrets Manager profile that has been initialized with:\
`ksm profile init <TOKEN>`\
\
See the [Profile Documentation](/keeperpam/secrets-manager/secrets-manager-command-line-interface/profile-command.md).
{% endhint %}

{% hint style="info" %}
**Sync dependencies:** Each non-JSON target requires Python packages. The CLI does not install these packages by default. If you installed the CLI with `pip`, install the packages for the target you sync to:

* **AWS** (`--type aws`) — `pip3 install 'keeper-secrets-manager-cli[aws]'`
* **Azure** (`--type azure`) — `pip3 install azure-identity azure-keyvault-secrets`
* **GCP** (`--type gcp`) — `pip3 install --upgrade google-cloud-secret-manager google-auth`

If you installed the CLI from a downloaded installer (macOS, Windows, or Linux package), `pip install` has no effect on that installation. Re-run the installer and enable the "Cloud Sync" component instead.

The `--type json` option does not require any extra dependencies.
{% endhint %}

parameters:

* `-t, --type` Type of the target key/value storage. Available types are:
  * `aws` - AWS Secrets Manager
  * `azure`- Azure Key Vault
  * `gcp` - GCP Secret Manager
  * `json` - lists all pending sync operations including both source and destination values
* `-m, --map <KEY NOTATION>` Map a destination key name to a Keeper notation URI.
* `-c, --credentials <uid>` UID of the Keeper record that contains credentials for the destination storage. Share this record with the Keeper Secrets Manager Application.

optional parameters:

* `-n, --dry-run` Run without making changes. The output shows whether each destination secret exists and whether its value would change (`dstExists`, `dstDiffers`). The output does not include live destination values.
* `-p, --preserve-missing` Preserve the destination value when the source secret is deleted.

#### AWS-Specific Options <a href="#aws-specific-options" id="aws-specific-options"></a>

* `-r`, `--record <RECORD>` Sync individual records by UID or title. Specify this option more than once to sync multiple records. If the CLI resolves a name by title instead of UID, it prints a warning to stderr. Titles can change. Use UIDs for scheduled syncs.
* `-f`, `--folder <FOLDER>` Sync all records from a folder, non-recursive. If the CLI resolves a name by path or folder name instead of UID, it prints a warning to stderr. Folder names can change. Use UIDs for scheduled syncs.
* `-fr`, `--folder-recursive <FOLDER>` Sync all records from a folder and all subfolders recursively. If the CLI resolves a name by path or folder name instead of UID, it prints a warning to stderr. Folder names can change. Use UIDs for scheduled syncs.
* `-px`, `--prefix <PREFIX>` Prefix added to every AWS secret name that the CLI derives from a record title. This option is required when you use `--record`, `--folder`, or `--folder-recursive`. The prefix must end in a separator character that is not a letter or digit (for example `keeper/` or `myapp-`). The CLI rejects a prefix that does not end this way.
* `-rj`, `--raw-json` Store the full JSON payload in the AWS secret. The format matches the output of `secret get <UID> --json`.

See the [AWS Secrets Manager Sync](/keeperpam/secrets-manager/integrations/aws-secrets-manager.md) documentation for detailed examples.

### Automation with Crontab <a href="#automation-with-crontab" id="automation-with-crontab"></a>

Use cron to run `ksm sync` on a schedule.

#### Example 1: Simple Daily Sync <a href="#example-1-simple-daily-sync-one-liner" id="example-1-simple-daily-sync-one-liner"></a>

Sync once per day at 2 AM:

```bash
# Edit crontab
crontab -e
# Add this line to sync Production folder daily at 2:00 AM
0 2 * * * /usr/local/bin/ksm sync -t aws -c <CRED_UID> --folder-recursive "Production" --prefix keeper/ >> /var/log/ksm-sync.log 2>&1
```

#### Example 2: Multi-Sync Shell Script <a href="#example-2-complex-multi-sync-script" id="example-2-complex-multi-sync-script"></a>

To run multiple sync operations with different mappings, create a shell script:

**Create `/home/user/scripts/ksm-sync-all.sh`:**

```bash
#!/usr/bin/env bash

# Configuration
CRED_UID="<YOUR_AWS_CRED_UID>"
# Sync with multiple custom mappings
ksm sync -t aws -c "$CRED_UID" \
    --map "legacy-db-password" "keeper://<UID>/field/password" \
    --map "api_key" "keeper://<UID>/custom_field/api_key" \
    --map "db_host" "keeper://<UID>/custom_field/hostname" \
    >> /var/log/ksm-sync.log 2>&1
# Split into multiple sync commands if the list is too long
ksm sync -t aws -c "$CRED_UID" \
    --map "db_password" "keeper://<UID>/field/password" \
    --map "db_login" "keeper://<UID>/custom_field/login" \
    >> /var/log/ksm-sync.log 2>&1

```

**Make the script executable:**

```bash
chmod +x /home/user/scripts/ksm-sync-all.sh
```

**Add to crontab to run every 6 hours:**

```bash
# Edit crontab
crontab -e
# Add this line to run the sync script every 6 hours
0 */6 * * * /home/user/scripts/ksm-sync-all.sh
```

## Sync Types

Select a provider to see the integration documentation.

{% content-ref url="/pages/34KiaAqCCWYeFK8n8tHW" %}
[AWS Secrets Manager Sync](/keeperpam/secrets-manager/integrations/aws-secrets-manager.md)
{% endcontent-ref %}

{% content-ref url="/pages/8LqKdN1gExiCxJhy1YW3" %}
[Azure Key Vault Sync](/keeperpam/secrets-manager/integrations/azure-key-vault.md)
{% endcontent-ref %}

{% content-ref url="/pages/bGhfkhAMwUdjtvng2lhQ" %}
[Google Cloud Secret Manager Sync](/keeperpam/secrets-manager/integrations/gcp-secret-manager.md)
{% endcontent-ref %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.keeper.io/keeperpam/secrets-manager/secrets-manager-command-line-interface/sync-command.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.