Skip to main content

ATTACH A RESOURCE POLICY TO A SECRETS MANAGER SECRET

This guide shows you how to grant one IAM role permission to read one secret. You do this by attaching a resource-based policy that is kept as a Swamp behavior.

Prerequisites

  • An existing secret, here myapp/production/db-password
  • The ARN of the role that needs read access, here arn:aws:iam::123456789012:role/app-reader
  • AWS credentials available through the default credential chain, or wired into the behavior's accessKeyId, secretAccessKey and sessionToken arguments with vault.get()

Pull the extension

swamp extension pull @swamp/aws/secretsmanager

The output looks like:

INF extension·pull: Pulling "@swamp/aws/secretsmanager"@"2026.10.13.1"
INF extension·pull: Identity verified: "@swamp/aws/secretsmanager"@"2026.10.13.1"
INF extension·pull: Pulled "@swamp/aws/secretsmanager"@"2026.10.13.1"
INF extension·pull: Extracted 12 files:

Define the policy

Create a behavior of type @swamp/aws/secretsmanager/resource-policy named db-password-policy. If you have not created a behavior before, see Create and Run a Behavior. The type requires name, SecretId and ResourcePolicy. Set the global arguments so the policy allows the role to call secretsmanager:GetSecretValue:

globalArguments:
  name: db-password-policy
  SecretId: myapp/production/db-password
  region: us-east-1
  ResourcePolicy:
    Version: "2012-10-17"
    Statement:
      - Effect: Allow
        Principal:
          AWS: arn:aws:iam::123456789012:role/app-reader
        Action: secretsmanager:GetSecretValue
        Resource: "*"

If you want AWS to reject policies that allow broad access to the secret, add BlockPublicPolicy: true.

Attach the policy

swamp behavior run db-password-policy create

This command attaches the resource policy to the secret in AWS and writes SecretsManager ResourcePolicy resource state as data.

Change who can read the secret

To change who can read the secret, edit the ResourcePolicy argument in the behavior definition. For example, add a principal or a second statement. Then run the behavior's update method the same way you ran create. The update method replaces the policy on the secret in AWS and writes the updated resource state as data.

The extensions reference lists every resource-policy argument and method.