AWS Secrets Manager资源策略不支持主体：IAM与联合用户配置求助

错误原因分析 #

1. Principal格式错误：你使用的arn:aws:iam::123456789:role/UAT-Developer/dev_user1@mycompany.com是临时角色会话ARN，这类动态生成的会话ARN无法作为资源策略的Principal，必须使用角色本身的ARN：arn:aws:iam::123456789:role/UAT-Developer。
2. JSON语法错误：第二次尝试的策略中，Principal对象重复定义AWS键，JSON不允许重复键，会导致其中一个权限规则被忽略。
3. 资源范围过宽：Resource: "*"会赋予所有Secret的操作权限，不符合最小权限原则，需要针对不同操作类型拆分资源范围。

修正后的完整策略 #

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": [
          "arn:aws:iam::123456789:user/IAMUser1",
          "arn:aws:iam::123456789:role/UAT-Developer"
        ]
      },
      "Action": [
        "secretsmanager:GetSecretValue",
        "secretsmanager:DescribeSecret",
        "secretsmanager:ListSecretVersionIds"
      ],
      "Resource": "arn:aws:secretsmanager:us-east-1:123456789:secret:your-secret-name-xxxx"
    },
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": [
          "arn:aws:iam::123456789:user/IAMUser1",
          "arn:aws:iam::123456789:role/UAT-Developer"
        ]
      },
      "Action": "secretsmanager:ListSecrets",
      "Resource": "*"
    }
  ]
}

关键说明 #

• 替换your-secret-name-xxxx为你实际的Secret ARN（可在Secrets Manager控制台的Secret详情页获取）。
• 第一个Statement针对具体Secret授权读取、描述、版本列表操作；第二个Statement单独处理账户级的ListSecrets操作（该操作无法指定单个Secret作为资源）。
• 角色ARNarn:aws:iam::123456789:role/UAT-Developer允许所有扮演该角色的联合用户访问，若需限制仅dev_user1@mycompany.com使用该角色访问，可添加条件规则。

限制指定联合用户的增强策略 #

如果需要确保只有dev_user1@mycompany.com能通过UAT-Developer角色访问Secret，可添加aws:SourceIdentity条件：

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": [
          "arn:aws:iam::123456789:user/IAMUser1",
          "arn:aws:iam::123456789:role/UAT-Developer"
        ]
      },
      "Action": [
        "secretsmanager:GetSecretValue",
        "secretsmanager:DescribeSecret",
        "secretsmanager:ListSecretVersionIds"
      ],
      "Resource": "arn:aws:secretsmanager:us-east-1:123456789:secret:your-secret-name-xxxx",
      "Condition": {
        "StringEquals": {
          "aws:SourceIdentity": "dev_user1@mycompany.com"
        }
      }
    },
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": [
          "arn:aws:iam::123456789:user/IAMUser1",
          "arn:aws:iam::123456789:role/UAT-Developer"
        ]
      },
      "Action": "secretsmanager:ListSecrets",
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "aws:SourceIdentity": "dev_user1@mycompany.com"
        }
      }
    }
  ]
}

内容的提问来源于stack exchange，提问作者Sarat Kota