Organization Administration

Back Next

IAM role configuration for AWS Secrets Manager

If you access AWS Secrets Manager using role-based authentication, you need to ensure that the IAM role that the Secure Agent uses to access secrets has the appropriate policies and permissions. You must also attach the role to your EC2 instance.

To configure the IAM role, first define a policy with the appropriate permissions, assign the policy to the role, and then update the role trust policy.

Step 1. Create an IAM policy and assign appropriate permissions.

Configure the following policy:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "secretsmanager:GetSecretValue",
                "secretsmanager:ListSecrets"
            ],
            "Resource": "*"
        }
    ]
}

The policy must be able to list and read secrets from Secrets Manager. The following image shows the minimum policies required:

The image shows the AWS policy details page for a policy named
"SecretManagerReadOnly." On the Permissions tab, under "Permissions defined
in this policy," the access level "Limited: List, Read" is granted to the
Secrets Manager service for all resources.

Step 2. Assign the policy to the IAM role.

Assign the policy you created to the role that the Secure Agent uses to access secrets, as shown in the following image:

The image shows the AWS role details page. On the Permissions tab under
"Permissions policies," the SecretManagerReadOnly customer-managed policy is
assigned.

Step 3. Update the IAM role trust policy.

After you assign the policy, update the IAM role trust policy to define which AWS resources can access the role. To do this, either allow any EC2 VM instance to access the role or allow the EC2 instance’s role to assume the role that has permission to read secrets.

If the IAM role is the same role as the EC2 instance’s role, you can have the role assume itself.

To allow any EC2 VM instance to access the role, configure the following trust policy:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "ec2.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

To allow the EC2 instance’s role to assume the role that has permission to read secrets, configure the following trust policy:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::<account ID>:role/<EC2 instance’s role>"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

The following image shows the trust policy:

The image shows the AWS role details page. On the "Trust relationships" tab
under "Trusted entities," the JSON code block specifies which entities can
assume the role.

For more information about assigning polices to IAM roles and attaching IAM roles to EC2 instances, see the AWS documentation.

Rename Saved Search

Table of Contents

Organization Administration

Organization Administration

IAM role configuration for AWS Secrets Manager

IAM role configuration for AWS Secrets Manager

Step 1. Create an IAM policy and assign appropriate permissions.

Step 2. Assign the policy to the IAM role.

Step 3. Update the IAM role trust policy.