Authentication and access control for Amazon Secrets Manager
Secrets Manager uses Amazon Identity and Access Management (IAM) to secure access to secrets. IAM provides authentication and access control. Authentication verifies the identity of individuals' requests. Secrets Manager uses a sign-in process with passwords, access keys, and multi-factor authentication (MFA) tokens to verify the identity of the users. See Signing in to Amazon. Access control ensures that only approved individuals can perform operations on Amazon resources such as secrets. Secrets Manager uses policies to define who has access to which resources, and which actions the identity can take on those resources. See Policies and permissions in IAM.
Secrets Manager administrator permissions
To grant Secrets Manager administrator permissions, follow the instructions at Adding and removing IAM identity permissions, and attach the following policies:
We recommend you do not grant administrator permissions to end users. While this allows your users to create and manage their secrets, the permission required to enable rotation (IAMFullAccess) grants significant permissions that are not appropriate for end users.
Permissions to access secrets
By using IAM permission policies, you control which users or services have access to your secrets. A permissions policy describes who can perform which actions on which resources. You can:
Permissions for Lambda rotation functions
Secrets Manager uses Amazon Lambda functions to rotate secrets. The Lambda function must have access to the secret as well as the database or service that the secret contains credentials for. See Permissions for rotation.
Permissions for encryption keys
Secrets Manager uses Amazon Key Management Service (Amazon KMS) keys to encrypt secrets. The
Amazon managed key aws/secretsmanager automatically has the correct permissions.
If you use a different KMS key, Secrets Manager needs permissions to that key. See Permissions for the KMS key.
Permissions for replication
By using IAM permission policies, you control which users or services can replicate your secrets to other Regions. See Prevent Amazon Secrets Manager replication.