Secrets Manager uses AWS Identity and Access Management (IAM) to secure access to secrets. IAM provides authentication and access control. Authentication verifies the identity of individuals' requests. Secrets Manager uses a sign-in process with passwords, access keys, and multi-factor authentication (MFA) tokens to verify the identity of the users. See Signing in to AWS. Access control ensures that only approved individuals can perform operations on AWS resources such as secrets. Secrets Manager uses policies to define who has access to which resources, and which actions the identity can take on those resources. See Policies and permissions in IAM.
Topics
Permissions reference for AWS Secrets Manager
The permissions reference for Secrets Manager is available at Actions, resources, and condition keys for AWS Secrets Manager in the Service Authorization Reference.
Secrets Manager administrator permissions
To grant Secrets Manager administrator permissions, follow the instructions at Adding and removing IAM identity permissions, and attach the following policies:
We recommend you do not grant administrator permissions to end users. While this allows your users to create and manage their secrets, the permission required to enable rotation (IAMFullAccess) grants significant permissions that are not appropriate for end users.
Permissions to access secrets
By using IAM permission policies, you control which users or services have access to your secrets. A permissions policy describes who can perform which actions on which resources. You can:
Permissions for Lambda rotation functions
Secrets Manager uses AWS Lambda functions to rotate secrets. The Lambda function must have access to the secret as well as the database or service that the secret contains credentials for. See Permissions for rotation.
Permissions for encryption keys
Secrets Manager uses AWS Key Management Service (AWS KMS) keys to encrypt secrets. The
AWS managed key aws/secretsmanager automatically has the correct permissions.
If you use a different KMS key, Secrets Manager needs permissions to that key. See Permissions for the KMS key.
Permissions for replication
By using IAM permission policies, you control which users or services can replicate your secrets to other Regions. See Prevent AWS Secrets Manager replication.
