secretsmanager:CreateSecret is a Write access-level action in the secretsmanager service. Grants permission to create a secret that stores encrypted data that can be queried and rotated
ARNs that secretsmanager:CreateSecret can be scoped to in an IAM policy.
Keys you can use in the Condition block of a policy that grants secretsmanager:CreateSecret.
Filters access by a key that is present in the request the user makes to the Secrets Manager service
Filters access by the tags associated with the resource
Filters access by the list of all the tag key names present in the request the user makes to the Secrets Manager service
Filters access by the list of Regions in which to replicate the secret
Filters access by the description text in the request
Filters access by whether to overwrite a secret with the same name in the destination Region
Filters access by the key ARN of the KMS key in the request
Filters access by the key identifier of the KMS key in the request. Deprecated: Use secretsmanager:KmsKeyArn
Filters access by the friendly name of the secret in the request
Filters access by a tag key and value pair
Filters access by the managed external secret type in the request
Filters access by the ARN of the rotation Lambda function associated with the secret
Filters access by the managed external secret type associated with the secret
A minimal policy that allows secretsmanager:CreateSecret. Replace "Resource": "*" with a specific ARN to follow least privilege.
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AllowSecretsmanagerCreateSecret",
"Effect": "Allow",
"Action": "secretsmanager:CreateSecret",
"Resource": "*"
}
]
}