secretsmanager:RotateSecret is a Write access-level action in the secretsmanager service. Grants permission to start rotation of a secret
ARNs that secretsmanager:RotateSecret can be scoped to in an IAM policy.
Keys you can use in the Condition block of a policy that grants secretsmanager:RotateSecret.
Filters access by the tags associated with the resource
Filters access by the managed external secret rotation role ARN in the request
Filters access by whether the rotation rules of the secret are to be modified
Filters access by a tag key and value pair
Filters access by whether the secret is to be rotated immediately
Filters access by the ARN of the rotation Lambda function in the request
Filters access by the SecretID value in the request
Filters access by primary region in which the secret is created if the secret is a multi-Region secret
Filters access by the ARN of the rotation Lambda function associated with the secret
Filters access by the managed external secret type associated with the secret
Filters access by a key that is present in the request the user makes to the Secrets Manager service
Filters access by the list of all the tag key names present in the request the user makes to the Secrets Manager service
A minimal policy that allows secretsmanager:RotateSecret. Replace "Resource": "*" with a specific ARN to follow least privilege.
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AllowSecretsmanagerRotateSecret",
"Effect": "Allow",
"Action": "secretsmanager:RotateSecret",
"Resource": "*"
}
]
}