IAM / security / secretsmanager

AWS Secrets Manager (IAM)

JSON →
AWSsecretsmanagersecurity

AWS Secrets Manager is a service for securely storing, rotating, and managing access to secrets such as database credentials, API keys, and other sensitive information.

iamaws
docs ↗
Permissions
Actions in this service
secretsmanager:ListSecrets
secretsmanager:DescribeSecret
secretsmanager:GetSecretValue
secretsmanager:CreateSecret
secretsmanager:PutSecretValue
secretsmanager:TagResource
secretsmanager:GetRandomPassword
secretsmanager:GetResourcePolicy
Policy
Minimal privilege example

Copy-paste least-privilege policy statement — not yet harness-verified.

{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "secretsmanager:ListSecrets", "secretsmanager:DescribeSecret", "secretsmanager:GetSecretValue", "secretsmanager:CreateSecret", "secretsmanager:PutSecretValue", "secretsmanager:TagResource", "secretsmanager:GetRandomPassword", "secretsmanager:GetResourcePolicy" ], "Resource": "*" } ] }
SDK mapping
Method → permission

SDK method mapping (e.g. boto3.get_object() → s3:GetObject) is not yet collected.

Footguns
Known gotchas
Avoid secretsmanager:* — grants full control including secret deletion and value retrieval
Avoid secretsmanager:GetSecretValue unless needed — exposes plaintext secret values
Resources
docshttps://servicereference.us-east-1.amazonaws.com/v1/secretsmanager/secretsmanager.json ↗