diff --git a/config-model/src/main/java/com/yahoo/vespa/model/container/xml/CloudAsmSecrets.java b/config-model/src/main/java/com/yahoo/vespa/model/container/xml/CloudAsmSecrets.java
new file mode 100644
index 000000000000..019e76e554ec
--- /dev/null
+++ b/config-model/src/main/java/com/yahoo/vespa/model/container/xml/CloudAsmSecrets.java
@@ -0,0 +1,31 @@
+// Copyright Vespa.ai. Licensed under the terms of the Apache 2.0 license. See LICENSE in the project root.
+package com.yahoo.vespa.model.container.xml;
+
+import ai.vespa.secret.config.aws.AsmSecretConfig;
+import com.yahoo.container.bundle.BundleInstantiationSpecification;
+import com.yahoo.osgi.provider.model.ComponentModel;
+import com.yahoo.vespa.model.container.component.SimpleComponent;
+
+import java.net.URI;
+
+/**
+ * @author lesters
+ */
+public class CloudAsmSecrets extends SimpleComponent implements AsmSecretConfig.Producer {
+
+    private static final String CLASS = "ai.vespa.secret.aws.AsmSecretStore";
+    private static final String BUNDLE = "jdisc-cloud-aws";
+
+    private final URI ztsUri;
+
+    public CloudAsmSecrets(URI ztsUri) {
+        super(new ComponentModel(BundleInstantiationSpecification.fromStrings(CLASS, CLASS, BUNDLE)));
+        this.ztsUri = ztsUri;
+    }
+
+    @Override
+    public void getConfig(AsmSecretConfig.Builder builder) {
+        builder.ztsUri(ztsUri.toString());
+    }
+
+}
diff --git a/config-model/src/main/java/com/yahoo/vespa/model/container/xml/ContainerModelBuilder.java b/config-model/src/main/java/com/yahoo/vespa/model/container/xml/ContainerModelBuilder.java
index 4a6cc80173ee..fbc195d9bec1 100644
--- a/config-model/src/main/java/com/yahoo/vespa/model/container/xml/ContainerModelBuilder.java
+++ b/config-model/src/main/java/com/yahoo/vespa/model/container/xml/ContainerModelBuilder.java
@@ -315,6 +315,7 @@ private void addSecrets(ApplicationContainerCluster cluster, Element spec, Deplo
                 secretsConfig.addSecret(key, name, vault);
             }
             cluster.addComponent(secretsConfig);
+            cluster.addComponent(new CloudAsmSecrets(deployState.getProperties().ztsUrl()));
         }
     }
 
diff --git a/container-disc/src/main/java/ai/vespa/secret/config/aws/package-info.java b/container-disc/src/main/java/ai/vespa/secret/config/aws/package-info.java
new file mode 100644
index 000000000000..1e505273b807
--- /dev/null
+++ b/container-disc/src/main/java/ai/vespa/secret/config/aws/package-info.java
@@ -0,0 +1,6 @@
+// Copyright Vespa.ai. Licensed under the terms of the Apache 2.0 license. See LICENSE in the project root.
+
+@ExportPackage
+package ai.vespa.secret.config.aws;
+
+import com.yahoo.osgi.annotation.ExportPackage;
diff --git a/jdisc-cloud-aws/src/main/resources/configdefinitions/asm-secret.def b/container-disc/src/main/resources/configdefinitions/asm-secret.def
similarity index 55%
rename from jdisc-cloud-aws/src/main/resources/configdefinitions/asm-secret.def
rename to container-disc/src/main/resources/configdefinitions/asm-secret.def
index 0ec42b27601d..56d9ad6d12b5 100644
--- a/jdisc-cloud-aws/src/main/resources/configdefinitions/asm-secret.def
+++ b/container-disc/src/main/resources/configdefinitions/asm-secret.def
@@ -1,5 +1,5 @@
 # Config for AsmSecretStore
 
-package=ai.vespa.secret.aws
+package=ai.vespa.secret.config.aws
 
 ztsUri string
diff --git a/jdisc-cloud-aws/src/main/java/ai/vespa/secret/aws/AsmSecretStore.java b/jdisc-cloud-aws/src/main/java/ai/vespa/secret/aws/AsmSecretStore.java
index 0ad1647c5109..078777dfaa5c 100644
--- a/jdisc-cloud-aws/src/main/java/ai/vespa/secret/aws/AsmSecretStore.java
+++ b/jdisc-cloud-aws/src/main/java/ai/vespa/secret/aws/AsmSecretStore.java
@@ -1,5 +1,6 @@
 package ai.vespa.secret.aws;
 
+import ai.vespa.secret.config.aws.AsmSecretConfig;
 import ai.vespa.secret.internal.TypedSecretStore;
 import ai.vespa.secret.model.Key;
 import ai.vespa.secret.model.Role;