assumed-role cannot access secret manager

Question

Hi,

I have an IAM role - , for AWS lambda function.
This IAM role has an policy attached to it:
```
{
    "Statement": [
        {
            "Action": [
                "kms:Encrypt",
                "kms:Decrypt"
            ],
            "Effect": "Allow",
            "Resource": "arn:aws:kms:us-east-2:key/",
            "Sid": "kms"
        },
        {
            "Action": "secretsmanager:GetSecretValue",
            "Effect": "Allow",
            "Resource": "arn:aws:secretsmanager:us-east-2::secret:-",
            "Sid": "secretsmanager"
        }
    ],
    "Version": "2012-10-17"
}
```
In the lambda function code, i try to get the secret value using python like:
```
import aws_lambda_powertools
from aws_lambda_powertools.utilities import parameters
json.loads(parameters.get_secret())
```
And in the output im getting error:
```
[ERROR] GetParameterError: An error occurred (AccessDeniedException) when calling the GetSecretValue operation: User: arn:aws:sts:::assumed-role// is not authorized to perform: secretsmanager:GetSecretValue on resource:  because no identity-based policy allows the secretsmanager:GetSecretValue action
```
What could be an issue? The role has a policy that allows this role to "GetSecretValue" out of , but the assumed role IAM identity cannot access it (if to believe the error message, and it is not misleading).

Thanks.

Answer

Another thing to take into consideration, is the accounts, if this is a cross account situation or not. Anyway, the first thing that I would check is the KMS policy you have attached to the KMS key. It's not enough providing permissions to the principal executing the lambda function. You need also to allow on the KMS key policy the usage by that principal. You can give on the KMS policy permissions to all the principals in one account to use it, or just to specific principals.

Here you have examples: https://docs.aws.amazon.com/dms/latest/userguide/security_iam_resource-based-policy-examples.html

To be more precise for your use case you would need something like this:

```
{
      "Sid": "Allow use of the key",
      "Effect": "Allow",
      "Principal": {
        "AWS": [
          "arn:aws:iam::987654321098:role/"
        ]
      },
      "Action": [
        "kms:Encrypt",
        "kms:Decrypt",
        "kms:ReEncrypt*",
        "kms:GenerateDataKey*",
        "kms:DescribeKey"
      ],
      "Resource": "*"
    },

```

Hope this helps,

Best.

Answer

Ensure your Lambda execution role also has KMS:Decrypt for the Key used to encrypt the secrect

assumed-role cannot access secret manager

Relevant content