AWS Secrets Resource Policy Wildcard Generalization

Question

I am trying to generalize a resource policy for an aws secret that multiple lambdas will grab from (project based). Currently what i have below works

{
  "Version" : "2012-10-17",
  "Statement" : [ {
    "Effect" : "Allow",
    "Principal" : {
      "AWS" : "arn:aws:iam::123456789999:role/lambda-a",
      "AWS" : "arn:aws:iam::123456789999:role/lambda-b"
    },
    "Action" : "secretsmanager:*",
    "Resource" : "*"
  } ]
}

The problem is that I need a variable amount of lambdas. I could write in 30 or so of these but wanted to know how to use wildcards to do this efficiently.

When I try below I get the error This resource policy contains a syntax error.

{
  "Version" : "2012-10-17",
  "Statement" : [ {
    "Effect" : "Allow",
    "Principal" : {
      "AWS" : "arn:aws:iam::123456789999:role/lambda-*",
    },
    "Action" : "secretsmanager:*",
    "Resource" : "*"
  } ]
}

And when I try to just eliminate the wildcard and specific path I get This resource policy contains an unsupported principal.

{
  "Version" : "2012-10-17",
  "Statement" : [ {
    "Effect" : "Allow",
    "Principal" : {
      "AWS" : "arn:aws:iam::123456789999"
    },
    "Action" : "secretsmanager:*",
    "Resource" : "*"
  } ]
}

Any ideas how to do this cleanly?

score 0 · Answer 1 · answered Jun 30 '23 at 20:57

I think this will likely do what you need. Instead of setting the principal as the role, set the principal to "*", but add a condition for the role with the wildcard:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "*",
      },
      "Action": "secretsmanager:*",
      "Resource": "*",
      "Condition": {
        "StringLike": {
          "aws:PrincipalArn": "arn:aws:iam::123456789999:role/lambda-*"
        }
      }
    }
  ]
}

AWS Secrets Resource Policy Wildcard Generalization

1 Answers1