How to use the @aws-cdk/aws-secretsmanager.Secret function in @aws-cdk/aws-secretsmanager

//
// Copyright (C) 2019 Dmitry Kolesnikov
//
// This file may be modified and distributed under the terms
// of the MIT license.  See the LICENSE file for details.
// https://github.com/fogfish/aws-cdk-pure
//
// Config/Secret Management HoC
//
import * as secret from '@aws-cdk/aws-secretsmanager'
import { IaaC, include, IPure } from 'aws-cdk-pure'

const defaultBucket = process.env.AWS_IAAC_CONFIG || 'undefined'
const vault = include(secret.Secret.fromSecretAttributes)

/**
 * returns a configuration as string value for given key as it is stored by AWS Secret Manager 
 *   
 * @param key name of the key
 * @param bucket AWS Secret Manager bucket, the value of AWS_IAAC_CONFIG env var is used as default bucket,
 */
export function String(key: string, bucket: string = defaultBucket): IPure {
  return vault(Config(bucket)).map(x => x.secretValueFromJson(key).toString())
}

function Config(secretArn: string): IaaC {
  const Secret = () => ({ secretArn })
  return Secret
}

readonly username: string;

  /**
   * The KMS key to use to encrypt the secret.
   *
   * @default default master key
   */
  readonly encryptionKey?: kms.IKey;
}

/**
 * A database secret.
 *
 * @resource AWS::SecretsManager::Secret
 */
export class DatabaseSecret extends secretsmanager.Secret {
  constructor(scope: Construct, id: string, props: DatabaseSecretProps) {
    super(scope, id, {
      encryptionKey: props.encryptionKey,
      generateSecretString: {
        passwordLength: 30, // Oracle password cannot have more than 30 characters
        secretStringTemplate: JSON.stringify({ username: props.username }),
        generateStringKey: 'password',
        excludeCharacters: '"@/\\'
      }
    });
  }
}