#4700 ABAC support in @swamp/aws-sm

Problem Statement

I would like to be able to limit Swamp's use of AWS Secrets Manager to avoid it having access to secrets in the same AWS account that are not its own. (Yes, I know all about having lots of AWS accounts. I'm a big fan. Nonetheless, sometimes I'm going to want Swamp to cohabitate with other things and today is one of those times.)

Proposed Solution

I would like to be able to give Swamp's AWS IAM identity a policy something like this:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Action": "secretsmanager:ListSecrets",
      "Effect": "Allow",
      "Resource": "*"
    },
    {
      "Action": "secretsmanager:CreateSecret",
      "Condition": {
        "StringEquals": { "aws:RequestTag/foo": "bar" }
      },
      "Effect": "Allow",
      "Resource": "*"
    },
    {
      "Action": [
        "secretsmanager:DeleteSecret",
        "secretsmanager:DescribeSecret",
        "secretsmanager:GetSecretValue",
        "secretsmanager:PutSecretValue",
        "secretsmanager:UpdateSecret"
      ],
      "Condition": {
        "StringEquals": { "aws:ResourceTag/foo": "bar" }
      },
      "Effect": "Allow",
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "secretsmanager:TagResource",
        "secretsmanager:UntagResource"
      ],
      "Condition": {
        "StringEquals": { "aws:ResourceTag/foo": "bar" },
        "ForAllValues:StringNotEquals": { "aws:TagKeys": ["foo"] }
      },
      "Resource": "*"
    }
  ]
}

I would like to be able to configure the @swamp/aws-sm extension to always create secrets with a specific tag (here "foo": "bar") and have it do so.

Alternatives Considered

• Instruct the agents to tag secrets and hope for the best: This will drive users slowly insane by feeling brittle and failing with inscrutable AWS permissions errors.
• Secrets named with a prefix: This relies on agents and humans remembering to use the prefix.

Additional Context