AWS Secrets Manager

Prerequisites

An Enkryptify workspace with admin access
An AWS account with permissions to create IAM roles and policies

Permissions

Enkryptify connects to your AWS account by assuming an IAM Role that you create. We use temporary credentials from sts:AssumeRole to manage secrets in AWS Secrets Manager.

Trust relationship:
- Trusted entity: AWS Account 676206939822 (Enkryptify)
- External ID: not required (will be added in a future update)
Required permissions on the assumed role (inline policy example below):
- secretsmanager:GetSecretValue
- secretsmanager:DescribeSecret
- secretsmanager:PutSecretValue
- secretsmanager:CreateSecret
- secretsmanager:DeleteSecret
- secretsmanager:TagResource
- secretsmanager:UpdateSecret

You may scope the Resource to specific secret ARNs. The example uses * for simplicity.

Steps to complete

Create a new sync

Go to the Syncs tab of your project and click on AWS Secrets Manager.

Start IAM role creation (trust setup)

In AWS IAM → Roles → Create role.
Trusted entity type: AWS Account → Another AWS Account.
Enter Account ID 676206939822.
External ID: not required (will be added in a future update).

Finish role creation

Skip the ‘Add permissions’ step.
Provide a role name and finish creation.

Attach Secrets Manager permissions

On the role page, go to Permissions → Add permissions → Create inline policy → JSON, then paste:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowSecretsManagerAccess",
      "Effect": "Allow",
      "Action": [
        "secretsmanager:GetSecretValue",
        "secretsmanager:DescribeSecret",
        "secretsmanager:PutSecretValue",
        "secretsmanager:CreateSecret",
        "secretsmanager:DeleteSecret",
        "secretsmanager:TagResource",
        "secretsmanager:UpdateSecret"
      ],
      "Resource": "*"
    }
  ]
}