title: AWS SecretsManager value won't resolve
body: <p>I'm using <code>aws-cdk-lib</code> (2.13.0). Here's a snippet of my code:</p>
  <pre><code>import { App, Stack } from 'aws-cdk-lib';
  import { Secret } from 'aws-cdk-lib/aws-secretsmanager';
  
  export class CognitoStack extends Stack {
    constructor(scope: App) {
      super(scope, 'cognito');
  
      const secret = this.getSecret('google');
      console.log({ secret });
    }
  
    public getSecret(path: string) {
      const secret = Secret.fromSecretNameV2(this, `Secret${path}`, path);
      console.log({ path, secret, secretArn: secret.secretArn, string: secret.secretValue.toString() });
      return secret.secretValue.toJSON();
    }
  }
  </code></pre>
  <p>The resulting logs look like this:</p>
  <p><div class="snippet" data-lang="js" data-hide="false" data-console="true" data-babel="false">
  <div class="snippet-code">
  <pre class="snippet-code-js lang-js prettyprint-override"><code>{
    path: 'google',
    secret: &lt;ref *1&gt; SecretBase {
      node: Node {
        host: [Circular *1],
        _locked: false,
        _children: {},
        _context: {},
        _metadata: [],
        _dependencies: Set(0) {},
        _validations: [Array],
        id: 'Secretgoogle',
        scope: [CognitoStack]
      },
      stack: CognitoStack {
        node: [Node],
        _missingContext: [],
        _stackDependencies: {},
        templateOptions: {},
        _logicalIds: [LogicalIDs],
        account: '${Token[AWS.AccountId.4]}',
        region: '${Token[AWS.Region.8]}',
        environment: 'aws://unknown-account/unknown-region',
        terminationProtection: undefined,
        _stackName: 'cognito',
        tags: [TagManager],
        artifactId: 'cognito',
        templateFile: 'cognito.template.json',
        _versionReportingEnabled: true,
        synthesizer: [DefaultStackSynthesizer],
        [Symbol(@aws-cdk/core.DependableTrait)]: [Object]
      },
      env: {
        account: '${Token[AWS.AccountId.4]}',
        region: '${Token[AWS.Region.8]}'
      },
      _physicalName: undefined,
      _allowCrossEnvironment: false,
      physicalName: '${Token[TOKEN.332]}',
      encryptionKey: undefined,
      secretName: 'google',
      secretArn: 'arn:${Token[AWS.Partition.7]}:secretsmanager:${Token[AWS.Region.8]}:${Token[AWS.AccountId.4]}:secret:google',
      autoCreatePolicy: false,
      [Symbol(@aws-cdk/core.DependableTrait)]: { dependencyRoots: [Array] }
    },
    secretArn: 'arn:${Token[AWS.Partition.7]}:secretsmanager:${Token[AWS.Region.8]}:${Token[AWS.AccountId.4]}:secret:google',
    string: '${Token[TOKEN.333]}'
  }
  { secret: '&lt;unresolved-token&gt;' }</code></pre>
  </div>
  </div>
  </p>
  <p>The results of the <code>npx cdk diff sandbox-cognito</code> look like this:</p>
  <pre><code>Stack sandbox-cognito
  Resources
  [~] AWS::Cognito::UserPoolIdentityProvider Google GoogleAF1E99FA
   └─ [~] ProviderDetails
       ├─ [-] Removed: .client_id
       └─ [-] Removed: .client_secret
  </code></pre>
  <p>Which means that it is removing the client_id/client_secret that I was able to set manually. Now that I'm trying to load the values from a secret, it is not working.</p>
  <p>The problem is that I cannot parse the JSON (notice the <code>&lt;unresolved-token&gt;</code> in the logs. I think that it is not yet resolved, but I'm not sure how to resolve... It's trying parse this string literal: <code>${Token[TOKEN.333]}</code>, instead of the secret value. How can I get the results of the secret string?</p>