AWS Administration Cookbook

Secret reader role

Due to the fine-grained nature of IAM permissions, you can easily segment the type of different access roles get to your AWS resources.

With the following IAM policy, you can ensure that the user/role can only read secret values (using a specific key and table), but they can never set or change them:

{   "Version": "2012-10-17",   "Statement": [     {       "Action": [         "kms:Decrypt"       ],       "Effect": "Allow",       "Resource": "arn:aws:kms:us-east-1:<your-account-id>:         key/<your-key-id>"     },     {       "Action": [         "dynamodb:GetItem",         "dynamodb:Query",         "dynamodb:Scan"       ],       "Effect": "Allow",       "Resource": "arn:aws:dynamodb:us-east-1:<your-account-id>:         table/credential-store"     }   ] }