Secrets Manager
Prefix secretsmanager, 27 actions · Domain Security, Identity & Compliance
36 AWS managed policies. 3 have reviewed guidance; the rest have authoritative permission data pending editorial review. 19 are service-linked role policies, shown with permission data only.
User access (4)
- AmazonDocDBElasticFullAccessAdmin
- AmazonRDSDataFullAccessHigh privilegeAdmin
- AWSMigrationHubOrchestratorInstanceRolePolicyReader
- SecretsManagerReadWriteAdmin
Operator and limited (8)
- AlexaForBusinessDeviceSetupOperator
- AmazonDataZonePreviewConsoleFullAccessOperator
- AmazonRedshiftQueryEditorOperator
- AWSQuickSightSecretsManagerWritePolicyOperator
- AWSSecretsManagerClientReadOnlyAccessOperator
- AWSThinkboxAWSPortalGatewayPolicyOperator
- AWSTransformSecretsManagerConnectorPolicyOperator
- DBModVirtualSourceOperator
Service roles (5)
Service-linked roles (19)
- AlexaForBusinessNetworkProfileServicePolicyOperator
- AmazonCognitoIdpServiceRolePolicyOperator
- AmazonEKSLocalOutpostServiceRolePolicyOperator
- AmazonEventBridgeApiDestinationsServiceRolePolicyOperator
- AmazonRDSBetaServiceRolePolicyOperator
- AmazonRDSPreviewServiceRolePolicyOperator
- AmazonRDSServiceRolePolicyOperator
- AmazonRedshiftServiceLinkedRolePolicyOperator
- AmazonTimestreamInfluxDBServiceRolePolicyOperator
- AppStudioServiceRolePolicyOperator
- AWSDataSyncDiscoveryServiceRolePolicyOperator
- AWSDataSyncServiceRolePolicyOperator
- AWSDirectConnectServiceRolePolicyReader
- AWSMarketplaceDeploymentServiceRolePolicyOperator
- AWSPanoramaServiceLinkedRolePolicyOperator
- AWSPCSServiceRolePolicyOperator
- AWSTransferServiceRolePolicyOperator
- AWSVPCS2SVpnServiceRolePolicyOperator
- KafkaServiceRolePolicyOperator
Also grants Secrets Manager actions (89)
- AccessAnalyzerServiceRolePolicy
- AdministratorAccess
- AgentRegistryFullAccess
- AIDevOpsAgentAccessPolicy
- AIDevOpsAgentActionsPolicy
- AIDevOpsOperatorAppAccessPolicy
- AIOpsAssistantPolicy
- AIOpsConsoleAdminPolicy
- AlexaForBusinessFullAccess
- AmazonAppFlowFullAccess
- AmazonBedrockStudioPermissionsBoundary
- AmazonDataZoneEnvironmentRolePermissionsBoundary
- AmazonDataZoneFullAccess
- AmazonDataZoneRedshiftGlueProvisioningPolicy
- AmazonDataZoneRedshiftManageAccessRolePolicy
- AmazonDataZoneSageMakerEnvironmentRolePermissionsBoundary
- AmazonEKSLocalOutpostClusterPolicy
- AmazonEventBridgeFullAccess
- AmazonEVSServiceRolePolicy
- AmazonFSxConsoleFullAccess
- AmazonKendraFullAccess
- AmazonLaunchWizard_Fullaccess
- AmazonLaunchWizardFullAccessV2
- AmazonRDSCustomInstanceProfileRolePolicy
- AmazonRDSCustomPreviewServiceRolePolicy
- AmazonRDSCustomServiceRolePolicy
- AmazonRedshiftAllCommandsFullAccess
- AmazonRedshiftDataFullAccess
- AmazonRedshiftFullAccess
- AmazonRedshiftQueryEditorV2FullAccess
- AmazonRedshiftQueryEditorV2NoSharing
- AmazonRedshiftQueryEditorV2ReadSharing
- AmazonRedshiftQueryEditorV2ReadWriteSharing
- AmazonSageMakerCanvasDataPrepFullAccess
- AmazonSageMakerCanvasFullAccess
- AmazonSageMakerFullAccess
- AmazonSecurityLakeAdministrator
- AssuranceServiceRolePolicy
- AWS_ConfigRole
- AWSApplicationMigrationFSxProxyPolicy
- AWSAuditManagerServiceRolePolicy
- AWSCODAPermissionsBoundary
- AWSConfigServiceRolePolicy
- AWSDataSyncFullAccess
- AWSEC2SqlHaInstancePolicy
- AWSECRPullThroughCache_ServiceRolePolicy
- AwsGlueDataBrewFullAccessPolicy
- AWSGlueDataBrewServiceRole
- AWSGreengrassResourceAccessRolePolicy
- AWSIoTSiteWiseConsoleFullAccess
- AWSLicenseManagerLinuxSubscriptionsServiceRolePolicy
- AWSLicenseManagerUserSubscriptionsServiceRolePolicy
- AWSMcpServiceActionsFullAccess
- AWSMigrationHubOrchestratorConsoleFullAccess
- AWSMigrationHubOrchestratorPlugin
- AWSMigrationHubStrategyCollector
- AWSMigrationHubStrategyConsoleFullAccess
- AWSPanoramaFullAccess
- AWSRefactoringToolkitFullAccess
- AWSResilienceHubV2AssessmentExecutionPolicy
- AWSResourceExplorerServiceRolePolicy
- AWSServiceRoleForAWSTransform
- AWSSupplyChainFederationAdminAccess
- AWSSupportServiceRolePolicy
- AWSThinkboxAWSPortalAdminPolicy
- AWSTransformInfrastructureExecutorAccessBatch
- AWSTransformInfrastructureExecutorAccessEC2
- AWSTransformServerMigrationAgentPolicy
- AWSWellArchitectedAgentResourceScanningServiceRolePolicy
- BedrockAgentCoreFullAccess
- CloudWatchEventsFullAccess
- CloudWatchOmniAWSIntegrationPolicy
- CloudWatchOmniSpaceAccessPolicy
- DBModDiscoveryAndAssessment
- DBModProvisioningAndMigration
- PowerUserAccess
- ReadOnlyAccess
- ResourceGroupsTaggingAPITagUntagSupportedResources
- ROSAInstallerPolicy
- SageMakerStudioAdminIAMDefaultExecutionPolicy
- SageMakerStudioAdminIAMPermissiveExecutionPolicy
- SageMakerStudioFullAccess
- SageMakerStudioProjectProvisioningRolePolicy
- SageMakerStudioProjectUserRolePermissionsBoundary
- SageMakerStudioProjectUserRolePolicy
- SageMakerStudioUserIAMDefaultExecutionPolicy
- SageMakerStudioUserIAMPermissiveExecutionPolicy
- SecurityAudit
- WellArchitectedAgentResourceScanning
acceptcrossaccountreplication associatecrossaccountreplica batchgetsecretvalue cancelrotatesecret createsecret deleteresourcepolicy deletesecret describesecret disassociatecrossaccountreplica getrandompassword getresourcepolicy getsecretvalue listresourcepolicies listsecretversionids listsecrets putresourcepolicy putsecretvalue removeregionsfromreplication replicatesecrettoregions restoresecret rotatesecret stopreplicationtoreplica tagresource untagresource updatesecret updatesecretversionstage validateresourcepolicy
Actions (27)
| Action | Access level | Policies granting without limits | Policies granting with resource or condition limits |
|---|---|---|---|
| secretsmanager:AcceptCrossAccountReplication | Write | 5 | 1 |
| secretsmanager:AssociateCrossAccountReplica | Write | 5 | 1 |
| secretsmanager:BatchGetSecretValue | Read | 6 | 2 |
| secretsmanager:CancelRotateSecret | Write | 5 | 1 |
| secretsmanager:CreateSecret | Write | 7 | 51 |
| secretsmanager:DeleteResourcePolicy | Permissions management | 5 | 5 |
| secretsmanager:DeleteSecret | Write | 5 | 40 |
| secretsmanager:DescribeSecret | Read | 19 | 48 |
| secretsmanager:DisassociateCrossAccountReplica | Write | 5 | 1 |
| secretsmanager:GetRandomPassword | Read | 14 | 1 |
| secretsmanager:GetResourcePolicy | Read | 16 | 7 |
| secretsmanager:GetSecretValue | Read | 5 | 73 |
| secretsmanager:ListResourcePolicies | Read | 9 | 1 |
| secretsmanager:ListSecretVersionIds | Read | 14 | 11 |
| secretsmanager:ListSecrets | List | 53 | 10 |
| secretsmanager:PutResourcePolicy | Permissions management | 5 | 17 |
| secretsmanager:PutSecretValue | Write | 5 | 30 |
| secretsmanager:RemoveRegionsFromReplication | Write | 5 | 3 |
| secretsmanager:ReplicateSecretToRegions | Write | 5 | 2 |
| secretsmanager:RestoreSecret | Write | 5 | 4 |
| secretsmanager:RotateSecret | Write | 5 | 10 |
| secretsmanager:StopReplicationToReplica | Write | 5 | 1 |
| secretsmanager:TagResource | Tagging | 6 | 31 |
| secretsmanager:UntagResource | Tagging | 6 | 4 |
| secretsmanager:UpdateSecret | Write | 5 | 24 |
| secretsmanager:UpdateSecretVersionStage | Write | 5 | 8 |
| secretsmanager:ValidateResourcePolicy | Permissions management | 5 | 1 |