Organization Administration

Back Next

Cross-account access configuration for AWS Secrets Manager

If the AWS account that hosts your secrets differs from the account that hosts the Secure Agent, you'll need to set up both accounts for cross-account access.

When you configure a connection to use a secrets manager, you choose the runtime environment for the connnection. If the runtime environment contains a Secure Agent that is hosted within an AWS account and this account differs from the account that hosts the secrets, you need to configure cross-account access. Configure cross-account access so that the Secure Agent can access the secrets.

To configure cross-account access, the resource that hosts the secrets needs to be in the same region as the region you choose when you enable your organization to use a secrets manager. For more information about enabling your organization to use a secrets manager, see Enabling and disabling a secrets manager.

Step 1. Set up the account that hosts the secrets.

To set up the account that hosts the secrets, you need to create a customer-managed KMS key, encrypt the secret using the key, and attach a resource policy to the secret. You can't use the AWS managed key for cross-account access.

Perform the following steps:

Create the KMS key by performing the following steps:

Navigate to

Customer Managed Keys

Create a new customer-managed key that has the following properties:

Property	Value
Key type	Symmetric
Key usage	Encrypt and Decrypt
Key administrators	Select the IAM users or roles that will manage the key.
Key users	Select the IAM users or roles that will use the key to encrypt and decrypt secrets.

Configure the following key policy to allow access to the IAM role in the account that hosts the Secure Agent:

{
  "Effect": "Allow",
  "Principal": {
    "AWS": "arn:aws:iam::<Secure Agent account>:role/EC2SecretReadOnly"
  },
  "Action": [
    "kms:Decrypt",
    "kms:DescribeKey"
  ],
  "Resource": "*"
}

Encrypt the secret in this account using the customer-managed key as shown in the following image, and click

Save

The image shows the AWS "Edit encryption key" dialog box for a secret. The customer-managed key is selected in the "Encryption key" drop-down list.

Attach the following resource policy to the secret:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::<Secure Agent account>:role/<application_role>"
      },
      "Action": "secretsmanager:GetSecretValue",
      "Resource": "*"
    }
  ]
}

Step 2. Set up the account that hosts the Secure Agent.

To set up the account that hosts the Secure Agent, attach an identity policy to the role that the agent uses, and then verify that the account that hosts the agent can fetch the KMS key from the account that hosts the secrets.

Attach the following identity policy to the the role that the agent uses to access secrets:

{
  "Version" : "2012-10-17",
  "Statement" : [
    {
      "Effect": "Allow",
      "Action": "secretsmanager:GetSecretValue",
      "Resource": "<secret ARN of secrets account>"
    },
    {
      "Effect": "Allow",
      "Action": "kms:Decrypt",
      "Resource": "<KMS key ARN of secrets account>"
    }
  ]
}

To verify that the account that hosts the agent can retrieve the KMS key, run the following command from the EC2 instance in the account that hosts the agent:

aws secretsmanager get-secret-value --secret-id '<secret ARN>'

For more information about configuring cross-account access, see "Access AWS Secrets Manager secrets from a different account" in the AWS documentation.

Rename Saved Search

Table of Contents

Organization Administration

Organization Administration

Cross-account access configuration for AWS Secrets Manager

Cross-account access configuration for AWS Secrets Manager

Step 1. Set up the account that hosts the secrets.

Step 2. Set up the account that hosts the Secure Agent.