Set Up AWS Secrets Manager Access

This article describes how to grant Ataccama ONE access to secrets stored in AWS Secrets Manager, so you can reference credentials such as database passwords and API keys from your own vault when configuring source connections.

As with Amazon S3 AWS Assume Role connections, ONE authenticates using AWS Assume Role with OpenID Connect (OIDC) federation: ONE presents a signed token to AWS Security Token Service (STS) and receives temporary credentials scoped to an IAM role you define. No long-lived AWS secrets are stored or transmitted.

This article applies to connections processed in Ataccama’s cloud runtime, where access is granted through OIDC federation.

If you retrieve secrets from an Ataccama edge instance instead, the trust policy and configuration are different as edge instances don’t use OIDC. Instead, the edge’s ECS task role assumes a customer-managed IAM role (gated by a mandatory tag). See Set Up AWS Secrets Manager Access for Edge.

Prerequisites

An AWS account with permissions to manage IAM identity providers and roles.
The ARNs of the AWS Secrets Manager secrets you want to expose to ONE.
For secrets encrypted with a customer-managed AWS KMS key: the KMS key ARN.

Setup overview

Register the Ataccama identity provider (IDP) as an OIDC provider in IAM and configure the role’s trust policy, as described in Set Up AWS OIDC Provider. The OIDC provider registration and trust policy are identical to the S3 setup; only the permissions policy differs.
Attach a permissions policy that grants Secrets Manager actions instead of S3 actions. See Secrets Manager permissions policy.
Record the role ARN. It has the format arn:aws:iam::<account-id>:role/<role-name>.

You provide this role ARN when you add the secret management service in ONE.

Secrets Manager permissions policy

Scope the policy to only the secrets ONE needs. Avoid Resource: "*".

Replace <region>, <account-id>, and the secret name pattern with your values.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowReadSecrets",
      "Effect": "Allow",
      "Action": [
        "secretsmanager:DescribeSecret",
        "secretsmanager:GetSecretValue"
      ],
      "Resource": [
        "arn:aws:secretsmanager:<region>:<account-id>:secret:<secret-name-or-prefix>*"
      ]
    }
  ]
}

If the secrets are encrypted with a customer-managed AWS KMS key, add a second statement granting kms:Decrypt on that key. You must also update the KMS key’s policy to allow the role to call kms:Decrypt; granting it in the IAM policy alone is not sufficient for customer-managed keys.

{
  "Sid": "AllowDecryptWithCustomerCmk",
  "Effect": "Allow",
  "Action": [
    "kms:Decrypt"
  ],
  "Resource": [
    "arn:aws:kms:<region>:<account-id>:key/<kms-key-id>"
  ]
}

Next steps

In ONE, add a secret management service using the role ARN, then reference your stored secrets when configuring source credentials.

Was this page useful?