Decide (and document) what it should do on delete

[plumdog]

Currently, on delete does nothing to the secret if it was passed in. That is, the custom resource makes no attempt to remove the secret values that it put into the secret from the secret.

This feels like slightly surprising behaviour, but so does removing values from the secret which may have been manually altered since creation - not usually a concern of Cloudformation things, but somewhat uniquely so in the case of SecretsManager.

[plumdog]

I think the answer here is that, by default, it should leave the value in the secret, but that it should be controllable with a switch.

[plumdog]

Additional consideration: on update, it still calls putSecretValue, so if this merges with whatever is already in the secret, then doing nothing on delete would sort of make sense. If however, this is a straight "make the secret contain this and only this", then it should empty the secret on delete.