Link Search Menu Expand Document

Secrets Manager

  • prefix: secretsmanager

Table of Contents

Privileges

CancelRotateSecret

  • description: Enables the user to cancel an in-progress secret rotation.
  • access level: Write
  • resource types
{
    "Secret": {
        "resource_type": "Secret",
        "required": true,
        "condition_keys": [],
        "dependent_actions": []
    },
    "": {
        "resource_type": "",
        "required": false,
        "condition_keys": [
            "secretsmanager:SecretId",
            "secretsmanager:resource/AllowRotationLambdaArn",
            "secretsmanager:ResourceTag/tag-key"
        ],
        "dependent_actions": []
    }
}

CreateSecret

  • description: Enables the user to create a secret that stores encrypted data that can be queried and rotated.
  • access level: Write
  • resource types
{
    "Secret": {
        "resource_type": "Secret",
        "required": true,
        "condition_keys": [],
        "dependent_actions": []
    },
    "": {
        "resource_type": "",
        "required": false,
        "condition_keys": [
            "secretsmanager:Name",
            "secretsmanager:Description",
            "secretsmanager:KmsKeyId",
            "aws:RequestTag/tag-key",
            "aws:TagKeys",
            "secretsmanager:ResourceTag/tag-key"
        ],
        "dependent_actions": []
    }
}

DeleteResourcePolicy

  • description: Enables the user to delete the resource policy attached to a secret.
  • access level: Permissions management
  • resource types
{
    "Secret": {
        "resource_type": "Secret",
        "required": true,
        "condition_keys": [],
        "dependent_actions": []
    },
    "": {
        "resource_type": "",
        "required": false,
        "condition_keys": [
            "secretsmanager:SecretId",
            "secretsmanager:resource/AllowRotationLambdaArn",
            "secretsmanager:ResourceTag/tag-key"
        ],
        "dependent_actions": []
    }
}

DeleteSecret

  • description: Enables the user to delete a secret.
  • access level: Write
  • resource types
{
    "Secret": {
        "resource_type": "Secret",
        "required": true,
        "condition_keys": [],
        "dependent_actions": []
    },
    "": {
        "resource_type": "",
        "required": false,
        "condition_keys": [
            "secretsmanager:SecretId",
            "secretsmanager:resource/AllowRotationLambdaArn",
            "secretsmanager:RecoveryWindowInDays",
            "secretsmanager:ForceDeleteWithoutRecovery",
            "secretsmanager:ResourceTag/tag-key"
        ],
        "dependent_actions": []
    }
}

DescribeSecret

  • description: Enables the user to retrieve the metadata about a secret, but not the encrypted data.
  • access level: Read
  • resource types
{
    "Secret": {
        "resource_type": "Secret",
        "required": true,
        "condition_keys": [],
        "dependent_actions": []
    },
    "": {
        "resource_type": "",
        "required": false,
        "condition_keys": [
            "secretsmanager:SecretId",
            "secretsmanager:resource/AllowRotationLambdaArn",
            "secretsmanager:ResourceTag/tag-key"
        ],
        "dependent_actions": []
    }
}

GetRandomPassword

  • description: Enables the user to generate a random string for use in password creation.
  • access level: Read
  • resource types
{
    "": {
        "resource_type": "",
        "required": false,
        "condition_keys": [],
        "dependent_actions": []
    }
}

GetResourcePolicy

  • description: Enables the user to get the resource policy attached to a secret.
  • access level: Read
  • resource types
{
    "Secret": {
        "resource_type": "Secret",
        "required": true,
        "condition_keys": [],
        "dependent_actions": []
    },
    "": {
        "resource_type": "",
        "required": false,
        "condition_keys": [
            "secretsmanager:SecretId",
            "secretsmanager:resource/AllowRotationLambdaArn",
            "secretsmanager:ResourceTag/tag-key"
        ],
        "dependent_actions": []
    }
}

GetSecretValue

  • description: Enables the user to retrieve and decrypt the encrypted data.
  • access level: Read
  • resource types
{
    "Secret": {
        "resource_type": "Secret",
        "required": true,
        "condition_keys": [],
        "dependent_actions": []
    },
    "": {
        "resource_type": "",
        "required": false,
        "condition_keys": [
            "secretsmanager:SecretId",
            "secretsmanager:VersionId",
            "secretsmanager:VersionStage",
            "secretsmanager:resource/AllowRotationLambdaArn",
            "secretsmanager:ResourceTag/tag-key"
        ],
        "dependent_actions": []
    }
}

ListSecretVersionIds

  • description: Enables the user to list the available versions of a secret.
  • access level: Read
  • resource types
{
    "Secret": {
        "resource_type": "Secret",
        "required": true,
        "condition_keys": [],
        "dependent_actions": []
    },
    "": {
        "resource_type": "",
        "required": false,
        "condition_keys": [
            "secretsmanager:SecretId",
            "secretsmanager:resource/AllowRotationLambdaArn",
            "secretsmanager:ResourceTag/tag-key"
        ],
        "dependent_actions": []
    }
}

ListSecrets

  • description: Enables the user to list the available secrets.
  • access level: List
  • resource types
{
    "": {
        "resource_type": "",
        "required": false,
        "condition_keys": [],
        "dependent_actions": []
    }
}

PutResourcePolicy

  • description: Enables the user to attach a resource policy to a secret.
  • access level: Permissions management
  • resource types
{
    "Secret": {
        "resource_type": "Secret",
        "required": true,
        "condition_keys": [],
        "dependent_actions": []
    },
    "": {
        "resource_type": "",
        "required": false,
        "condition_keys": [
            "secretsmanager:SecretId",
            "secretsmanager:resource/AllowRotationLambdaArn",
            "secretsmanager:ResourceTag/tag-key",
            "secretsmanager:BlockPublicPolicy"
        ],
        "dependent_actions": []
    }
}

PutSecretValue

  • description: Enables the user to create a new version of the secret with new encrypted data.
  • access level: Write
  • resource types
{
    "Secret": {
        "resource_type": "Secret",
        "required": true,
        "condition_keys": [],
        "dependent_actions": []
    },
    "": {
        "resource_type": "",
        "required": false,
        "condition_keys": [
            "secretsmanager:SecretId",
            "secretsmanager:resource/AllowRotationLambdaArn",
            "secretsmanager:ResourceTag/tag-key"
        ],
        "dependent_actions": []
    }
}

RestoreSecret

  • description: Enables the user to cancel deletion of a secret.
  • access level: Write
  • resource types
{
    "Secret": {
        "resource_type": "Secret",
        "required": true,
        "condition_keys": [],
        "dependent_actions": []
    },
    "": {
        "resource_type": "",
        "required": false,
        "condition_keys": [
            "secretsmanager:SecretId",
            "secretsmanager:resource/AllowRotationLambdaArn",
            "secretsmanager:ResourceTag/tag-key"
        ],
        "dependent_actions": []
    }
}

RotateSecret

  • description: Enables the user to start rotation of a secret.
  • access level: Write
  • resource types
{
    "Secret": {
        "resource_type": "Secret",
        "required": true,
        "condition_keys": [],
        "dependent_actions": []
    },
    "": {
        "resource_type": "",
        "required": false,
        "condition_keys": [
            "secretsmanager:SecretId",
            "secretsmanager:RotationLambdaARN",
            "secretsmanager:resource/AllowRotationLambdaArn",
            "secretsmanager:ResourceTag/tag-key"
        ],
        "dependent_actions": []
    }
}

TagResource

  • description: Enables the user to add tags to a secret.
  • access level: Tagging
  • resource types
{
    "Secret": {
        "resource_type": "Secret",
        "required": true,
        "condition_keys": [],
        "dependent_actions": []
    },
    "": {
        "resource_type": "",
        "required": false,
        "condition_keys": [
            "secretsmanager:SecretId",
            "aws:RequestTag/tag-key",
            "aws:TagKeys",
            "secretsmanager:resource/AllowRotationLambdaArn",
            "secretsmanager:ResourceTag/tag-key"
        ],
        "dependent_actions": []
    }
}

UntagResource

  • description: Enables the user to remove tags from a secret.
  • access level: Tagging
  • resource types
{
    "Secret": {
        "resource_type": "Secret",
        "required": true,
        "condition_keys": [],
        "dependent_actions": []
    },
    "": {
        "resource_type": "",
        "required": false,
        "condition_keys": [
            "secretsmanager:SecretId",
            "aws:TagKeys",
            "secretsmanager:resource/AllowRotationLambdaArn",
            "secretsmanager:ResourceTag/tag-key"
        ],
        "dependent_actions": []
    }
}

UpdateSecret

  • description: Enables the user to update a secret with new metadata or with a new version of the encrypted data.
  • access level: Write
  • resource types
{
    "Secret": {
        "resource_type": "Secret",
        "required": true,
        "condition_keys": [],
        "dependent_actions": []
    },
    "": {
        "resource_type": "",
        "required": false,
        "condition_keys": [
            "secretsmanager:SecretId",
            "secretsmanager:Description",
            "secretsmanager:KmsKeyId",
            "secretsmanager:resource/AllowRotationLambdaArn",
            "secretsmanager:ResourceTag/tag-key"
        ],
        "dependent_actions": []
    }
}

UpdateSecretVersionStage

  • description: Enables the user to move a stage from one secret to another.
  • access level: Write
  • resource types
{
    "Secret": {
        "resource_type": "Secret",
        "required": true,
        "condition_keys": [],
        "dependent_actions": []
    },
    "": {
        "resource_type": "",
        "required": false,
        "condition_keys": [
            "secretsmanager:SecretId",
            "secretsmanager:VersionStage",
            "secretsmanager:resource/AllowRotationLambdaArn",
            "secretsmanager:ResourceTag/tag-key"
        ],
        "dependent_actions": []
    }
}

ValidateResourcePolicy

  • description: Enables the user to validate a resource policy before attaching policy.
  • access level: Permissions management
  • resource types
{
    "Secret": {
        "resource_type": "Secret",
        "required": true,
        "condition_keys": [],
        "dependent_actions": []
    },
    "": {
        "resource_type": "",
        "required": false,
        "condition_keys": [
            "secretsmanager:SecretId",
            "secretsmanager:resource/AllowRotationLambdaArn",
            "secretsmanager:ResourceTag/tag-key"
        ],
        "dependent_actions": []
    }
}