AWS Secrets Manager (secretsmanager)

Updates

Actions

• AcceptCrossAccountReplication
  
  Resources
  

  • Old_type: NoneType

    New_type: bool

    Old_value: None

    New_value: Yes

• AssociateCrossAccountReplica
  
  Resources
  

  • Old_type: NoneType

    New_type: bool

    Old_value: None

    New_value: Yes

• DisassociateCrossAccountReplica
  
  Resources
  

  • Old_type: NoneType

    New_type: bool

    Old_value: None

    New_value: Yes

• ListResourcePolicies
  
  Resources
  

  • Old_type: NoneType

    New_type: bool

    Old_value: None

    New_value: Yes

Additions

Actions

• AcceptCrossAccountReplication
  
  • Access:  Write
  • Resources: 

    Name: Secret

    Required: None

  • Conditions: 

    aws:ResourceTag/${TagKey}

    secretsmanager:CrossAccountReplicaARN

    secretsmanager:ReplicaRestriction

    secretsmanager:ReplicationRoleARN

    secretsmanager:ResourceTag/tag-key

    secretsmanager:SecretId

    secretsmanager:SecretPrimaryRegion

    secretsmanager:resource/AllowRotationLambdaArn

• AssociateCrossAccountReplica
  
  • Access:  Write
  • Resources: 

    Name: Secret

    Required: None

  • Conditions: 

    aws:ResourceTag/${TagKey}

    secretsmanager:CrossAccountReplicaARN

    secretsmanager:ReplicaRestriction

    secretsmanager:ReplicationRoleARN

    secretsmanager:ResourceTag/tag-key

    secretsmanager:SecretId

    secretsmanager:SecretPrimaryRegion

    secretsmanager:resource/AllowRotationLambdaArn

• DisassociateCrossAccountReplica
  
  • Access:  Write
  • Resources: 

    Name: Secret

    Required: None

  • Conditions: 

    aws:ResourceTag/${TagKey}

    secretsmanager:CrossAccountReplicaARN

    secretsmanager:ResourceTag/tag-key

    secretsmanager:SecretId

    secretsmanager:SecretPrimaryRegion

    secretsmanager:resource/AllowRotationLambdaArn

• ListResourcePolicies
  
  • Access:  Read
  • Resources: 

    Name: Secret

    Required: None

  • Conditions: 

    aws:ResourceTag/${TagKey}

    secretsmanager:ResourceTag/tag-key

    secretsmanager:SecretId

    secretsmanager:SecretPrimaryRegion

    secretsmanager:resource/AllowRotationLambdaArn

    secretsmanager:resource/Type

Conditions

• secretsmanager:CrossAccountPrimaryARN
  
  • Type:  ARN
• secretsmanager:CrossAccountReplicaARN
  
  • Type:  ARN
• secretsmanager:PolicyName
  
  • Type:  String
• secretsmanager:ReplicaRestriction
  
  • Type:  String
• secretsmanager:ReplicationRoleARN
  
  • Type:  ARN

Updates

Actions

• DeleteSecret
  
  Conditions
  
  • ＋ secretsmanager:CrossAccountPrimaryARN
• DescribeSecret
  
  Conditions
  
  • ＋ secretsmanager:PolicyName
• ListSecrets
  
  Conditions
  
  • ＋ secretsmanager:PolicyName
• RestoreSecret
  
  Conditions
  
  • ＋ secretsmanager:PolicyName

Resources

• Secret
  
  Conditions
  
  • ＋ secretsmanager:SecretPrimaryRegion