Secrets Manager

This AWS integration allows you to configure CloudTruth External Parameters from your AWS Secrets Manager.

Adding Integrations

To create a new or additional AWS account click Add AWS Account from the Integrations AWS page to bring up the add account pane. Add a name for the AWS account, your specific AWS account ID and the AWS account role name.‌ CloudTruth allows you to select regions where your resources exist, all US regions are enabled by default.

The Secrets Manager integration supports CloudTruth push actions. To enable Push Actions select Write Access for the integration and apply the write access inline policy for Secrets Manager.

Check the AWS Secret Manager integration and click Save.​‌

The AWS account will enter an Integration Error state until the AWS role is configured. An auto generated External Id will be created to use in the AWS Role Creation.

Configuring the AWS Role

With the provided External ID create your AWS Role.

AWS Secret Store Inline Policy

‌Adding an Inline Policy to the AWS Role allows CloudTruth secure access to the selected integration service. The inline policy is automatically created if you used CloudFormation or Terraform to create the role.

From the AWS IAM Console select the role that you created for CloudTruth access.

Click Add Inline Policy.​

Click the JSON Tab.​‌

Paste in the following JSON for the AWS Secret Store integration policy and click Review Policy.

External Parameter Policy

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "ListSecrets",
            "Effect": "Allow",
            "Action": "secretsmanager:ListSecrets",
            "Resource": "*"
        },
        {
            "Sid": "SecretAccess",
            "Effect": "Allow",
            "Action": [
                "secretsmanager:GetSecretValue",
                "secretsmanager:DescribeSecret"
            ],
            "Resource": "*"
        }
    ]
}

Write Access Parameter Policy for Push actions

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "ListSecrets",
            "Effect": "Allow",
            "Action": "secretsmanager:ListSecrets",
            "Resource": "*"
        },
        {
            "Sid": "SecretAccess",
            "Effect": "Allow",
            "Action": [
                "secretsmanager:CreateSecret",
                "secretsmanager:DeleteSecret",
                "secretsmanager:GetSecretValue",
                "secretsmanager:DescribeSecret",
                "secretsmanager:TagResource",
                "secretsmanager:UpdateSecret"
            ],
            "Resource": "*"
        }
    ]
}

Type in a name for the policy and click Create Policy.​‌​