Amazon Secrets Manager Secrets Manager Resource Policy API
The Secrets Manager Resource Policy API from Amazon Secrets Manager — 4 operation(s) for secrets manager resource policy.
Work with this as data
Every API here is available over the APIs.io API and to AI agents over MCP.
MCP server
One button, every client — Claude, Cursor, VS Code and the rest.
https://apis.io/mcp
Tools for apis
7 MCP tools reach this
find_apisBrowse and filter every API in the catalog.get_api_artifactsOne API's artifacts, grouped by type.get_openapiThe primary OpenAPI for this API.find_similar_apisAPIs that look like this one.apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.resolveTurn a domain, URL or GitHub org into the provider it belongs to.find_cohortsEvery scored population of providers in the catalog.
Call it yourself
curl for this page
This API
curl "https://apis.io/api/v1/apis/amazon-secrets-manager:amazon-secrets-manager-resource-policy-api"
All apis
curl "https://apis.io/api/v1/apis?limit=25"Calls without X-API-Key need no key. Calls with it need a paid plan — get a key.
Get an API key
Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.
A second provider on the same verified email joins the account you already have.
OpenAPI Specification
openapi: 3.2.0
info:
title: AWS Secrets Manager Resource Policy API
version: '2017-10-17'
description: Generated from AWS's published Smithy model for AWS Secrets Manager. 4 operation(s).
contact:
name: Amazon Web Services
url: https://aws.amazon.com/contact-us/
license:
name: Apache 2.0
identifier: Apache-2.0
url: https://github.com/aws/api-models-aws/blob/main/LICENSE
servers:
- url: https://secretsmanager.{region}.amazonaws.com
variables:
region:
default: us-east-1
security:
- sigv4: []
tags:
- name: Resource Policy
paths:
/#DeleteResourcePolicy:
post:
operationId: DeleteResourcePolicy
summary: Delete Resource Policy
description: 'Deletes the resource-based permission policy attached to the secret. To attach a policy to a secret, use PutResourcePolicy. Secrets Manager generates a CloudTrail log entry when you call this action. Do not include sensitive information in request parameters because it might be logged. For more information, see Logging Secrets Manager events with CloudTrail. Required permissions: secretsmanager:DeleteResourcePolicy. For more information, see IAM policy actions for Secrets Manager and Authentication and access control in Secrets Manager.'
responses:
'200':
description: Success
content:
application/x-amz-json-1.1:
schema:
$ref: '#/components/schemas/DeleteResourcePolicyResponse'
example:
ARN: arn:aws:secretsmanager:us-west-2:123456789012:secret:MyTestDatabaseSecret-a1b2c3
Name: MyTestDatabaseSecret
'500':
description: InternalServiceError
content:
application/x-amz-json-1.1:
schema:
$ref: '#/components/schemas/InternalServiceError'
'400':
description: InvalidParameterException; InvalidRequestException; ResourceNotFoundException
content:
application/x-amz-json-1.1:
schema:
$ref: '#/components/schemas/InvalidParameterException'
parameters:
- name: X-Amz-Target
in: header
required: true
schema:
type: string
enum:
- secretsmanager.DeleteResourcePolicy
requestBody:
required: true
content:
application/x-amz-json-1.1:
schema:
$ref: '#/components/schemas/DeleteResourcePolicyRequest'
example:
SecretId: MyTestDatabaseSecret
tags:
- Resource Policy
/#GetResourcePolicy:
post:
operationId: GetResourcePolicy
summary: Get Resource Policy
description: 'Retrieves the JSON text of the resource-based policy document attached to the secret. For more information about permissions policies attached to a secret, see Permissions policies attached to a secret. Secrets Manager generates a CloudTrail log entry when you call this action. Do not include sensitive information in request parameters because it might be logged. For more information, see Logging Secrets Manager events with CloudTrail. Required permissions: secretsmanager:GetResourcePolicy. For more information, see IAM policy actions for Secrets Manager and Authentication and access control in Secrets Manager.'
responses:
'200':
description: Success
content:
application/x-amz-json-1.1:
schema:
$ref: '#/components/schemas/GetResourcePolicyResponse'
example:
ARN: arn:aws:secretsmanager:us-west-2:123456789012:secret:MyTestDatabaseSecret-a1b2c3
Name: MyTestDatabaseSecret
ResourcePolicy: '{
"Version":"2012-10-17",
"Statement":[{
"Effect":"Allow",
"Principal":{
"AWS":"arn:aws:iam::123456789012:root"
},
"Action":"secretsmanager:GetSecretValue",
"Resource":"*"
}]
}'
'500':
description: InternalServiceError
content:
application/x-amz-json-1.1:
schema:
$ref: '#/components/schemas/InternalServiceError'
'400':
description: InvalidParameterException; InvalidRequestException; ResourceNotFoundException
content:
application/x-amz-json-1.1:
schema:
$ref: '#/components/schemas/InvalidParameterException'
parameters:
- name: X-Amz-Target
in: header
required: true
schema:
type: string
enum:
- secretsmanager.GetResourcePolicy
requestBody:
required: true
content:
application/x-amz-json-1.1:
schema:
$ref: '#/components/schemas/GetResourcePolicyRequest'
example:
SecretId: MyTestDatabaseSecret
tags:
- Resource Policy
/#PutResourcePolicy:
post:
operationId: PutResourcePolicy
summary: Put Resource Policy
description: 'Attaches a resource-based permission policy to a secret. A resource-based policy is optional. For more information, see Authentication and access control for Secrets Manager For information about attaching a policy in the console, see Attach a permissions policy to a secret. Secrets Manager generates a CloudTrail log entry when you call this action. Do not include sensitive information in request parameters because it might be logged. For more information, see Logging Secrets Manager events with CloudTrail. Required permissions: secretsmanager:PutResourcePolicy. For more information, see IAM policy actions for Secrets Manager and Authentication and access control in Secrets Manager.'
responses:
'200':
description: Success
content:
application/x-amz-json-1.1:
schema:
$ref: '#/components/schemas/PutResourcePolicyResponse'
example:
ARN: arn:aws:secretsmanager:us-west-2:123456789012:secret:MyTestDatabaseSecret-a1b2c3
Name: MyTestDatabaseSecret
'500':
description: InternalServiceError
content:
application/x-amz-json-1.1:
schema:
$ref: '#/components/schemas/InternalServiceError'
'400':
description: InvalidParameterException; InvalidRequestException; MalformedPolicyDocumentException; PublicPolicyException; ResourceNotFoundException
content:
application/x-amz-json-1.1:
schema:
$ref: '#/components/schemas/InvalidParameterException'
parameters:
- name: X-Amz-Target
in: header
required: true
schema:
type: string
enum:
- secretsmanager.PutResourcePolicy
requestBody:
required: true
content:
application/x-amz-json-1.1:
schema:
$ref: '#/components/schemas/PutResourcePolicyRequest'
example:
SecretId: MyTestDatabaseSecret
ResourcePolicy: '{
"Version":"2012-10-17",
"Statement":[{
"Effect":"Allow",
"Principal":{
"AWS":"arn:aws:iam::123456789012:root"
},
"Action":"secretsmanager:GetSecretValue",
"Resource":"*"
}]
}'
tags:
- Resource Policy
/#ValidateResourcePolicy:
post:
operationId: ValidateResourcePolicy
summary: Validate Resource Policy
description: 'Validates that a resource policy does not grant a wide range of principals access to your secret. A resource-based policy is optional for secrets. The API performs three checks when validating the policy: Sends a call to Zelkova, an automated reasoning engine, to ensure your resource policy does not allow broad access to your secret, for example policies that use a wildcard for the principal. Checks for correct syntax in a policy. Verifies the policy does not lock out a caller. Secrets Manager generates a CloudTrail log entry when you call this action. Do not include sensitive information in request parameters because it might be logged. For more information, see Logging Secrets Manager events with CloudTrail. Required permissions: secretsmanager:ValidateResourcePolicy and secretsmanager:PutResourcePolicy. For more information, see IAM policy actions for Secrets Manager and Authentication and access control in Secrets Manager.'
responses:
'200':
description: Success
content:
application/x-amz-json-1.1:
schema:
$ref: '#/components/schemas/ValidateResourcePolicyResponse'
example:
PolicyValidationPassed: true
ValidationErrors: []
'500':
description: InternalServiceError
content:
application/x-amz-json-1.1:
schema:
$ref: '#/components/schemas/InternalServiceError'
'400':
description: InvalidParameterException; InvalidRequestException; MalformedPolicyDocumentException; ResourceNotFoundException
content:
application/x-amz-json-1.1:
schema:
$ref: '#/components/schemas/InvalidParameterException'
parameters:
- name: X-Amz-Target
in: header
required: true
schema:
type: string
enum:
- secretsmanager.ValidateResourcePolicy
requestBody:
required: true
content:
application/x-amz-json-1.1:
schema:
$ref: '#/components/schemas/ValidateResourcePolicyRequest'
example:
SecretId: MyTestDatabaseSecret
ResourcePolicy: '{
"Version":"2012-10-17",
"Statement":[{
"Effect":"Allow",
"Principal":{
"AWS":"arn:aws:iam::123456789012:root"
},
"Action":"secretsmanager:GetSecretValue",
"Resource":"*"
}]
}'
tags:
- Resource Policy
components:
schemas:
ValidateResourcePolicyRequest:
type: object
properties:
SecretId:
type: string
description: The ARN or name of the secret with the resource-based policy you want to validate.
ResourcePolicy:
type: string
description: A JSON-formatted string that contains an Amazon Web Services resource-based policy. The policy in the string identifies who can access or manage this secret and its versions. For example policies, see Permissions policy examples.
required:
- ResourcePolicy
ValidateResourcePolicyResponse:
type: object
properties:
PolicyValidationPassed:
type: boolean
description: True if your policy passes validation, otherwise false.
ValidationErrors:
type: array
items:
$ref: '#/components/schemas/ValidationErrorsEntry'
description: Validation errors if your policy didn't pass validation.
PutResourcePolicyRequest:
type: object
properties:
SecretId:
type: string
description: The ARN or name of the secret to attach the resource-based policy. For an ARN, we recommend that you specify a complete ARN rather than a partial ARN. See Finding a secret from a partial ARN.
ResourcePolicy:
type: string
description: A JSON-formatted string for an Amazon Web Services resource-based policy. For example policies, see Permissions policy examples.
BlockPublicPolicy:
type: boolean
description: 'Specifies whether to block resource-based policies that allow broad access to the secret, for example those that use a wildcard for the principal. By default, public policies aren''t blocked. Resource policy validation and the BlockPublicPolicy parameter help protect your resources by preventing public access from being granted through the resource policies that are directly attached to your secrets. In addition to using these features, carefully inspect the following policies to confirm that they do not grant public access: Identity-based policies attached to associated Amazon Web Services pri'
required:
- SecretId
- ResourcePolicy
ValidationErrorsEntry:
type: object
properties:
CheckName:
type: string
description: Checks the name of the policy.
ErrorMessage:
type: string
description: Displays error messages if validation encounters problems during validation of the resource policy.
GetResourcePolicyRequest:
type: object
properties:
SecretId:
type: string
description: The ARN or name of the secret to retrieve the attached resource-based policy for. For an ARN, we recommend that you specify a complete ARN rather than a partial ARN. See Finding a secret from a partial ARN.
required:
- SecretId
DeleteResourcePolicyResponse:
type: object
properties:
ARN:
type: string
description: The ARN of the secret that the resource-based policy was deleted for.
Name:
type: string
description: The name of the secret that the resource-based policy was deleted for.
DeleteResourcePolicyRequest:
type: object
properties:
SecretId:
type: string
description: The ARN or name of the secret to delete the attached resource-based policy for. For an ARN, we recommend that you specify a complete ARN rather than a partial ARN. See Finding a secret from a partial ARN.
required:
- SecretId
PutResourcePolicyResponse:
type: object
properties:
ARN:
type: string
description: The ARN of the secret.
Name:
type: string
description: The name of the secret.
InternalServiceError:
type: object
properties:
Message:
type: string
GetResourcePolicyResponse:
type: object
properties:
ARN:
type: string
description: The ARN of the secret that the resource-based policy was retrieved for.
Name:
type: string
description: The name of the secret that the resource-based policy was retrieved for.
ResourcePolicy:
type: string
description: A JSON-formatted string that contains the permissions policy attached to the secret. For more information about permissions policies, see Authentication and access control for Secrets Manager.
InvalidParameterException:
type: object
properties:
Message:
type: string
securitySchemes:
sigv4:
type: apiKey
in: header
name: Authorization
description: AWS Signature Version 4. The Authorization header carries an AWS4-HMAC-SHA256 signature over the canonical request, with X-Amz-Date (and X-Amz-Security-Token for temporary credentials). Not a bearer token.
x-aws-sigv4:
signingName: secretsmanager
x-provenance:
method: harvested
publisher: Amazon Web Services
source: https://raw.githubusercontent.com/aws/api-models-aws/582e55931c45b944739742a2c1620b6026dd2d13/models/secrets-manager/service/2017-10-17/secrets-manager-2017-10-17.json
note: converted by smithy-to-openapi.py from AWS's Smithy model (roadmap#1001)