AWS Secrets Manager Credential Provider

The SailPoint AWS Secrets Manager Credential Provider provides credential cycling functionality to fetch credentials from AWS Secrets Manager to authenticate sources in SailPoint.

This credential provider fetches the latest credentials for the connectors to transact with source systems for identity security operations in SailPoint.

For information on creating a new AWS Secrets Manager credential provider, refer to Adding a New Credential Provider in SailPoint.

Prerequisites

Before you configure your credential provider, you must consider the following prerequisite items.

• For VA-based Deep Governance connectors, the source and credential provider virtual appliances must be in the same cluster.
• VA-based Deep Governance connectors, SaaS-based Deep Governance, Discovery, and Quick Compliance connectors now support the use of credential providers.

Secrets Manager uses AWS Identity and Access Management (IAM) to secure access to secrets. IAM provides authentication and access control. By using IAM permission policies, you control which users or services have access to your secrets. A permissions policy describes who can perform which actions on which resources. You can:

• Attach a permissions policy to an identity (IAM User/Role).
• Attach a permissions policy to a secret.

The GetSecretValue permission is necessary to retrieve secrets from AWS Secrets Manager.

The IMDS hop limit should be set to 2 as shown. If set to 1, the connection fails with a 401 error.

aws ec2 --profile dev describe-instances --instance-id i-0c42f9be78225a897 --query 'Reservations[].Instances[].MetadataOptions'
[
    {
        "State": "applied",
        "HttpTokens": "required",
        "HttpPutResponseHopLimit": 2,
        "HttpEndpoint": "enabled",
        "HttpProtocolIpv6": "disabled",
        "InstanceMetadataTags": "disabled"
    }
]

Identity-Based Policy

You can attach permissions policies to IAM identities: users, user groups, and roles. In an identity-based policy, you can specify which secrets the identity can access and the actions the identity can perform on the secrets. The following is an example of the identity-based policy for the user or role to access a secret that uses a custom KMS key.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "statement1",
            "Effect": "Allow",
            "Action": ["secretsmanager:GetSecretValue"],
            "Resource": "*"
        },
        {
            "Sid": "statement2",
            "Effect": "Allow",
            "Action": ["kms:Decrypt"],
            "Resource": ["arn:aws:kms:us-east-1:441113549707:key/6326462b-0ea3-4ad5-ad2f-32447ec4387a"]
        }
    ]
}

Resource-Based Policy

In a resource-based policy, you can specify who can access the secret and the actions they can perform on the secret. The following is an example of the resource-based policy for the user or role to access the secret that uses a custom KMS key.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::{AccountID}:role/{RoleName}"
            },
            "Action": "secretsmanager:GetSecretValue",
            "Resource": "*"
        }
    ]
}

• Principal: Who to grant access to.
• Action: What they can do. For more information, refer to Secrets Manager Actions.
• Resource: Which secrets they can access. For more information, refer to Secrets Manager Resources. The wildcard character (*) has different meanings depending on what you attach the policy to:
  • In a policy attached to a secret, the wildcard character (*) means the policy applies to this secret.
  • In a policy attached to an identity, the wildcard character (*) means the policy applies to all resources, including secrets, in the account. For more information about resource-based policies for AWS Secrets Manager, refer to Resource-based Policies.

Supported Platforms

This credential provider supports the following platforms:

• AWS Secrets Manager

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.