AWS Secrets Manager

Available on AWS Managed Clusters. You can also access AWS Secrets Manager from a GCP Managed Cluster using cross-cloud static credentials.

From an AWS Managed Cluster

Choose the authentication method that best fits your security requirements:

AWS Automatic Authentication
AWS Role ARN
AWS Static Credentials

This authentication gives you access to all secrets located in the same AWS account as your cluster.

AWS Automatic & AWS Role authentications are mutually exclusive.

This is the simplest and quickest way to use your external secrets inside your services.The following information is required:

The target AWS Region where your secrets live
The secret manager access name

Qovery automatically creates an AWS IAM Role with the following permissions:

IAM permissions details for AWS Secrets Manager

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "secretsmanager:GetResourcePolicy",
        "secretsmanager:GetSecretValue",
        "secretsmanager:DescribeSecret",
        "secretsmanager:ListSecretVersionIds",
        "secretsmanager:ListSecrets"
      ],
      "Resource": "*"
    }
  ]
}

Requirements to use your KMS key

If your secrets are encrypted with a customer-managed KMS key (rather than the default AWS-managed key), you must also grant the kms:Decrypt action on your Role permissions by adding the following:

{
  "Sid": "AllowKMSDecrypt",
  "Effect": "Allow",
  "Action": "kms:Decrypt",
  "Resource": "arn:aws:kms:region:accountid:key/your-key-id"
}

You must create the AWS Role in the same AWS account as your cluster.

AWS Automatic & AWS Role authentications are mutually exclusive.

Creating your own AWS Role lets you control which secrets are accessible.The following information is required:

The target AWS Region where your secrets live
Your AWS Role ARN
The secret manager access name

Use our CloudFormation stack to create the AWS Role

Use our CloudFormation stack to create the AWS Role with the necessary permissions.

Setup Steps:

Open CloudFormation: click on the link “Cloudformation stack”
- This opens AWS CloudFormation in a new tab (login to AWS if needed)
In AWS CloudFormation Console:
- Click Next (template is pre-filled with Qovery’s requirements)
- Stack name: Keep default qovery-secrets-manager-role-creation or customize
- Parameters:
  - OIDCProviderURL: this is your cluster OIDC Provider URL automatically filled, no need to edit it
  - RoleName: this is the name of the IAM Role that will be created, keep default or customize
- ✅ Important: Check “I acknowledge that AWS CloudFormation might create IAM resources”
- Click Create stack
Wait for completion (~1 minute):
- Status changes: CREATE_IN_PROGRESS → CREATE_COMPLETE
- Refresh page if needed
Get the Role ARN:
- Click on the Outputs tab
- Find RoleARN key
- Copy the value

You can edit the permissions attached to the created role to restrict access to your secrets as you wish (see below):

IAM permissions for AWS Secrets Manager

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "secretsmanager:GetResourcePolicy",
        "secretsmanager:GetSecretValue",
        "secretsmanager:DescribeSecret",
        "secretsmanager:ListSecretVersionIds",
        "secretsmanager:ListSecrets"
      ],
      "Resource": "*"
    }
  ]
}

You can restrict access to specific resources using wildcards.However, secretsmanager:ListSecrets must always target Resource: "*" — AWS does not support resource-level restrictions for this action. Without it, Qovery cannot list available secrets when configuring an external secret.Example:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "secretsmanager:GetResourcePolicy",
        "secretsmanager:GetSecretValue",
        "secretsmanager:DescribeSecret",
        "secretsmanager:ListSecretVersionIds"
      ],
      "Resource": "arn:aws:secretsmanager:eu-west-3:XXXXXXXXXXXX:secret:staging*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "secretsmanager:ListSecrets"
      ],
      "Resource": "*"
    }
  ]
}

Requirements to use your KMS key

If your secrets are encrypted with a customer-managed KMS key (rather than the default AWS-managed key), you must also grant the kms:Decrypt action on your Role permissions by adding the following:

{
  "Sid": "AllowKMSDecrypt",
  "Effect": "Allow",
  "Action": "kms:Decrypt",
  "Resource": "arn:aws:kms:region:accountid:key/your-key-id"
}

To read secrets kept in another AWS account, set the optional Role ARN to assume and External ID fields. The External Secrets Operator signs in with the role above, then assumes this second role through sts:AssumeRole. The second role’s trust policy must allow the role above, and require the external ID if one is set.

The following information is required:

Your AWS Access Key
Your AWS Secret Access Key
The target AWS Region where your secrets live
The secret manager access name

You need to configure the following permissions:

IAM permissions for AWS Secrets Manager

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "secretsmanager:GetResourcePolicy",
        "secretsmanager:GetSecretValue",
        "secretsmanager:DescribeSecret",
        "secretsmanager:ListSecretVersionIds",
        "secretsmanager:ListSecrets"
      ],
      "Resource": "*"
    }
  ]
}

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "secretsmanager:GetResourcePolicy",
        "secretsmanager:GetSecretValue",
        "secretsmanager:DescribeSecret",
        "secretsmanager:ListSecretVersionIds"
      ],
      "Resource": "arn:aws:secretsmanager:eu-west-3:XXXXXXXXXXXX:secret:staging*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "secretsmanager:ListSecrets"
      ],
      "Resource": "*"
    }
  ]
}

Requirements to use your KMS key

If your secrets are encrypted with a customer-managed KMS key (rather than the default AWS-managed key), you must also grant the kms:Decrypt action on your Role permissions by adding the following:

{
  "Sid": "AllowKMSDecrypt",
  "Effect": "Allow",
  "Action": "kms:Decrypt",
  "Resource": "arn:aws:kms:region:accountid:key/your-key-id"
}

From a GCP Managed Cluster (cross-cloud)

You can access AWS Secrets Manager from a GCP cluster using static credentials. The following information is required:

Your AWS Access Key
Your AWS Secret Access Key
The target AWS Region where your secrets live
The secret manager access name

You need to configure the following permissions:

IAM permissions for AWS Secrets Manager

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "secretsmanager:GetResourcePolicy",
        "secretsmanager:GetSecretValue",
        "secretsmanager:DescribeSecret",
        "secretsmanager:ListSecretVersionIds",
        "secretsmanager:ListSecrets"
      ],
      "Resource": "*"
    }
  ]
}

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "secretsmanager:GetResourcePolicy",
        "secretsmanager:GetSecretValue",
        "secretsmanager:DescribeSecret",
        "secretsmanager:ListSecretVersionIds"
      ],
      "Resource": "arn:aws:secretsmanager:eu-west-3:XXXXXXXXXXXX:secret:staging*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "secretsmanager:ListSecrets"
      ],
      "Resource": "*"
    }
  ]
}

Requirements to use your KMS key

If your secrets are encrypted with a customer-managed KMS key (rather than the default AWS-managed key), you must also grant the kms:Decrypt action on your Role permissions by adding the following:

{
  "Sid": "AllowKMSDecrypt",
  "Effect": "Allow",
  "Action": "kms:Decrypt",
  "Resource": "arn:aws:kms:region:accountid:key/your-key-id"
}

← Back to Secret Manager Integration overview

Overview

Account & Organization

Clusters & Cloud

Source Control

Projects & Environments

Services

Deployment & CI/CD

Environment Variables & Secrets

Observability

Notifications

Networking & Advanced

AWS Secrets Manager

From an AWS Managed Cluster

Use our CloudFormation stack to create the AWS Role

From a GCP Managed Cluster (cross-cloud)

​From an AWS Managed Cluster

​Use our CloudFormation stack to create the AWS Role

​From a GCP Managed Cluster (cross-cloud)

From an AWS Managed Cluster

Use our CloudFormation stack to create the AWS Role

From a GCP Managed Cluster (cross-cloud)