Lambda denied secret manager update

Question

I have a lambda function that can read secrets just fine, but fails to update the secret with the newer token data. The error returns that the assumed execution role does not have the necessary rights to the secret to perform an update action. However, based on the IAM simulator, the role should be able to read/write the secret. So in summary, the policies appear to be setup correctly and attached to the execution role of the Lambda script. ARN's to the secrets are correct. I did not however, create a resource based policy for the secret itself as to my understanding, that is not required as long as the execution role policy has the required ARN's and rights.

Riku_Kobayashi · Answer

Hello.

What IAM policy is set for the IAM role configured on Lambda?  
If you are using rotation to update secrets, you will need a policy called "secretsmanager:RotateSecret".  
If you want to update as is, the policy "secretsmanager:UpdateSecret" is required.  
https://docs.aws.amazon.com/service-authorization/latest/reference/list_awssecretsmanager.html

Lambda denied secret manager update

Relevant content