CloudFormation unable to Import an AWS::SecretsManager::Secret using --import-existing-resources?

Based on your analysis, you're correct that the AWS::SecretsManager::Secret resource appears to be unsupported for CloudFormation import using the --import-existing-resources feature. The key issue is that the primary identifier (Id) for the Secret resource is a read-only property, which conflicts with the fifth requirement you mentioned.

This is indeed challenging for secrets management, as secrets are resources that often need to persist beyond the lifecycle of a CloudFormation stack.

When attempting to import resources into CloudFormation, there are several requirements that must be met, and having a primary identifier that's a read-only property is a blocker for the automatic import feature.

For CloudFormation import to work properly, the resource must have a primary identifier that can be specified in the template, and it cannot be a read-only property. Since the Id property of AWS::SecretsManager::Secret is read-only, this prevents the automatic import.

As for changing this situation, there are a few potential approaches:

1. You could use the standard resource import process (not the automatic one) if the resource type is supported in the list of importable resources.

2. Consider using a different approach for managing secrets that need to survive stack rebuilds, such as creating them outside of CloudFormation and referencing them in your templates.

3. You might want to submit a feature request to AWS through your account team or AWS support to request that they make AWS::SecretsManager::Secret importable.

Unfortunately, there's no immediate solution to make the automatic import work for this resource type given the current constraints with the primary identifier being read-only.
Sources
Cloudformation Import stopped working | AWS re:Post