Restricting access to an AWS resource using a specific pattern of AWS roles

Question

I want all roles of my AWS account having a specific pattern to be able to access a Secrets Manager secret. I know I can use Condition block and wildcard matching for that.

However, the Principal field is required in a resource policy.

Will the following policy restrict access to just the roles matching the pattern?

{
  "Statement": [
    {
      "Action": [
        "secretsmanager:UpdateSecret",
        "secretsmanager:GetSecretValue"
      ],
      "Condition": {
        "StringLike": {
          "aws:PrincipalArn": "arn:aws:iam::12345678910:role/my_role_*"
        }
      },
      "Principal": { "AWS": "arn:aws:iam::12345678910:root" },
      "Effect": "Allow",
      "Resource": "arn:aws:secretsmanager:us-east-1:12345678910:secret:some-secret-1234",
      "Sid": "rp1"
    }
  ],
  "Version": "2012-10-17"
}

Answer 1

Use the wildcard "All Principal": {"AWS": "*"} . The combination of a same-account Account Principal + wildcard condition works in role *trust* policies ¹ but apparently not in *resource* policies ² .

---

The IAM docs say:

You can specify the role principal as the principal in a resource-based policy or create a broad-permission policy [with a wildcard Principal] that uses the aws:PrincipalArn condition key.

Because the condition contains the account number, the All Principal is no more permissive than the Account Principal would be. Also, because the policy is always tied to a specific secret resource, the wildcard "*" Resoure is no more permissive than the secret name. Finally, while an ArnLike condition is not always equivalent to StringLike , it is identical in this case.

{
  "Version" : "2012-10-17",
  "Statement" : [ {
    "Effect" : "Allow",
    "Principal" : {  "AWS" : "*" },
    "Action" : [ "secretsmanager:DescribeSecret", "secretsmanager:GetSecretValue" ],
    "Resource" : "arn:aws:secretsmanager:us-east-1:12345678910:secret:some-secret-1234",
    "Condition" : {
      "ArnLike" : {
        "aws:PrincipalArn" : "arn:aws:iam::12345678910:role/my_role_*"
      }
    }
  } ]
}

---

1. See the wildcard permissions section of the AWS blog post How to use trust policies with IAM roles for a trust policy example.

2. Error using a Lambda role + secrets manager resource policy with a same-account Account Principal: ...no identity-based policy allows the secretsmanager:GetSecretValue action .