aws secretsmanager put-resource-policy

Attaches a resource-based permission policy to a secret. AWS CLI reference

1 example 3 options Its page in the AWS CLI reference

Examples

from aws-cli, each command read by CmdID

To add a resource-based policy to a secret

The following put-resource-policy example adds a permissions policy to a secret, checking first that the policy does not provide broad access to the secret. The policy is read from a file. For more information, see Loading AWS CLI parameters from a file in the AWS CLI User Guide.

aws secretsmanager put-resource-policy --secret-id MyTestSecret --resource-policy file://mypolicy.json --block-public-policy

Identify

--secret-idThe ARN or name of the secret to attach the resource-based policy.

--resource-policyA JSON-formatted string for an Amazon Web Services resource-based policy.

--block-public-policySpecifies whether to block resource-based policies that allow broad access to the secret, for example those that use a wildcard for the principal.

Contents of mypolicy.json:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::123456789012:role/MyRole"
            },
            "Action": "secretsmanager:GetSecretValue",
            "Resource": "*"
        }
    ]
}

Its output

{
    "ARN": "arn:aws:secretsmanager:us-west-2:123456789012:secret:MyTestSecret-a1b2c3",
    "Name": "MyTestSecret"
}

For more information, see Attach a permissions policy to a secret in the Secrets Manager User Guide.

Options

3 in the AWS CLI reference

--block-public-policySpecifies whether to block resource-based policies that allow broad access to the secret, for example those that use a wildcard for the principal.

--resource-policyA JSON-formatted string for an Amazon Web Services resource-based policy.

--secret-idThe ARN or name of the secret to attach the resource-based policy.