aws secretsmanager validate-resource-policy

Validates that a resource policy does not grant a wide range of principals access to your secret. AWS CLI reference

1 example 2 options Its page in the AWS CLI reference

Examples

from aws-cli, each command read by CmdID

To validate a resource policy

The following validate-resource-policy example checks that a resource policy doesn't grant broad access to a secret. The policy is read from a file on disk. For more information, see Loading AWS CLI parameters from a file in the AWS CLI User Guide.

aws secretsmanager validate-resource-policy --resource-policy file://mypolicy.jsonIdentify

--resource-policyA JSON-formatted string that contains an Amazon Web Services resource-based policy.

Contents of mypolicy.json:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::123456789012:role/MyRole"
            },
            "Action": "secretsmanager:GetSecretValue",
            "Resource": "*"
        }
    ]
}

Its output

{
    "PolicyValidationPassed": true,
    "ValidationErrors": []
}

For more information, see Resource-based policies in the Secrets Manager User Guide.

Options

2 in the AWS CLI reference

--resource-policyA JSON-formatted string that contains an Amazon Web Services resource-based policy.

--secret-idThe ARN or name of the secret with the resource-based policy you want to validate.