resource_policies

Creates, updates, deletes, gets or lists a resource_policies resource.

Overview

Name	resource_policies
Type	Resource
Id	aws.secretsmanager.resource_policies

Fields

The following fields are returned by SELECT queries:

get_resource_policy

Name	Datatype	Description
arn	string	The ARN of the secret that the resource-based policy was retrieved for.
name	string	The name of the secret that the resource-based policy was retrieved for.
resource_policy	string	A JSON-formatted string that contains the permissions policy attached to the secret. For more information about permissions policies, see Authentication and access control for Secrets Manager.

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
get_resource_policy	select	region		Retrieves the JSON text of the resource-based policy document attached to the secret. For more information about permissions policies attached to a secret, see Permissions policies attached to a secret. Secrets Manager generates a CloudTrail log entry when you call this action. Do not include sensitive information in request parameters because it might be logged. For more information, see Logging Secrets Manager events with CloudTrail. Required permissions: secretsmanager:GetResourcePolicy. For more information, see IAM policy actions for Secrets Manager and Authentication and access control in Secrets Manager.
put_resource_policy	replace	region, SecretId, ResourcePolicy		Attaches a resource-based permission policy to a secret. A resource-based policy is optional. For more information, see Authentication and access control for Secrets Manager For information about attaching a policy in the console, see Attach a permissions policy to a secret. Secrets Manager generates a CloudTrail log entry when you call this action. Do not include sensitive information in request parameters because it might be logged. For more information, see Logging Secrets Manager events with CloudTrail. Required permissions: secretsmanager:PutResourcePolicy. For more information, see IAM policy actions for Secrets Manager and Authentication and access control in Secrets Manager.
delete_resource_policy	delete	region		Deletes the resource-based permission policy attached to the secret. To attach a policy to a secret, use PutResourcePolicy. Secrets Manager generates a CloudTrail log entry when you call this action. Do not include sensitive information in request parameters because it might be logged. For more information, see Logging Secrets Manager events with CloudTrail. Required permissions: secretsmanager:DeleteResourcePolicy. For more information, see IAM policy actions for Secrets Manager and Authentication and access control in Secrets Manager.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
region	string	AWS region (default: us-east-1)

SELECT examples

get_resource_policy

Retrieves the JSON text of the resource-based policy document attached to the secret. For more information about permissions policies attached to a secret, see Permissions policies attached to a secret. Secrets Manager generates a CloudTrail log entry when you call this action. Do not include sensitive information in request parameters because it might be logged. For more information, see Logging Secrets Manager events with CloudTrail. Required permissions: secretsmanager:GetResourcePolicy. For more information, see IAM policy actions for Secrets Manager and Authentication and access control in Secrets Manager.

SELECT
arn,
name,
resource_policy
FROM aws.secretsmanager.resource_policies
WHERE region = '{{ region }}' -- required
;

REPLACE examples

put_resource_policy

Attaches a resource-based permission policy to a secret. A resource-based policy is optional. For more information, see Authentication and access control for Secrets Manager For information about attaching a policy in the console, see Attach a permissions policy to a secret. Secrets Manager generates a CloudTrail log entry when you call this action. Do not include sensitive information in request parameters because it might be logged. For more information, see Logging Secrets Manager events with CloudTrail. Required permissions: secretsmanager:PutResourcePolicy. For more information, see IAM policy actions for Secrets Manager and Authentication and access control in Secrets Manager.

REPLACE aws.secretsmanager.resource_policies
SET 
SecretId = '{{ SecretId }}',
ResourcePolicy = '{{ ResourcePolicy }}',
BlockPublicPolicy = {{ BlockPublicPolicy }}
WHERE 
region = '{{ region }}' --required
AND SecretId = '{{ SecretId }}' --required
AND ResourcePolicy = '{{ ResourcePolicy }}' --required
RETURNING
arn,
name;

DELETE examples

delete_resource_policy

Deletes the resource-based permission policy attached to the secret. To attach a policy to a secret, use PutResourcePolicy. Secrets Manager generates a CloudTrail log entry when you call this action. Do not include sensitive information in request parameters because it might be logged. For more information, see Logging Secrets Manager events with CloudTrail. Required permissions: secretsmanager:DeleteResourcePolicy. For more information, see IAM policy actions for Secrets Manager and Authentication and access control in Secrets Manager.

DELETE FROM aws.secretsmanager.resource_policies
WHERE region = '{{ region }}' --required
;