Secrets (Optional)

arn:aws:iam::4177557XXXXX:role/ADBSSecretManagerServiceRole-XXXXXXXXXXXX

1. From the Choose secret type section, select the Other type of secret option.
2. In the Key/value pairs section, select the Plaintext tab, and then enter your password in the field.
3. In the Encryption key section, select or add an encryption key.
4. Select the Next button.

1. Secret name: Enter a descriptive name for the secret. The name must contain only alphanumeric characters and the characters (/, _ ,+, = ,. ,@, -).
2. Description: This field is optional.
3. Tags: If you want to add a new tag, select the Add button. This field is optional.
4. Resource permissions: This field is optional. If you want to add or edit a resource policy to access secrets across your AWS accounts, select the Edit permissions.
5. Replicate secret: This section is optional.
6. Select the Next button.

1. From the AWS Console, navigate to IAM. Select Policies, and then select the Create policy button.
2. In the Specify permissions step, enter the following information:
   1. Policy editor: Select the Visual tab .
   2. Service: Select Secrets Manager from the list.
   3. Expand the Actions allowed section to allow permission to retrieve the secret value.
      1. Choose the Allow option under Effect.
      2. Expand the Read section, and then select the GetSecretValue and DescribeValue checkbox.
      
   4. Resources: Specify the required secret. Select the Add ARNs button to add your ARN that you previously created and copied.
3. In the Review and create step, enter the following information:
   1. Provide a policy name.
   2. Provide a description. This step is optional.
   
4. Select Create policy.
5. Once it is created, you can review your policy details from the list.

1. From the AWS Console, navigate to IAM. Select Roles, and then select the Create role button.
2. In the Select trusted entity step, enter the following information:
   1. Trusted entity type: Choose AWS account.
   2. An AWS account: Choose the AWS account option and then enter the service Account ID associated with the OCI owned service role.
      Note
      
      Obtain your service Account ID from the Create OCI Owned Service Role (step 1f).
   3. Select Next.
   
3. In the Add permissions step, enter the following information:
   1. Select the IAM policy created in the previous step.
   2. You can create more granular trust relationships to improve the security posture. Examples of trust relationships that you can use:
      • Trust relationship with conditions: It restricts AssumeRole by using ExternalId to help prevent the confused deputy problem. AssumeRole grants OCI customer credentials. Also restrict SourceIdentity to the service role that you create in the first step on the Settings page.

        {
            "Version": "2012-10-17",
            "Statement": [
                {
                    "Effect": "Allow",
                    "Principal": {
                        "AWS": "arn:aws:iam::4177557XXXXX:root"
                    },
                    "Action": "sts:AssumeRole",
                    "Condition": {
                        "StringEquals": {
                            "sts:ExternalId": "ocid1.tenancy.oc1..XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
                        },
                        "ArnLike": {
                            "aws:PrincipalArn": "arn:aws:iam::4177557XXXXX:role/ADBSSecretManagerServiceRole-XXXXXXXXXXXX"
                        }
                    }
                },
                {
                    "Effect": "Allow",
                    "Principal": {
                        "AWS": "arn:aws:iam::4177557XXXXX:root"
                    },
                    "Action": [
                        "sts:SetSourceIdentity",
                        "sts:TagSession"
                    ],
                    "Condition": {
                        "ArnLike": {
                            "aws:PrincipalArn": "arn:aws:iam::4177557XXXXX:role/ADBSSecretManagerServiceRole-XXXXXXXXXXXX"
                        }
                    }
                }
            ]
        }

        Replace the service Account ID information with the Account ID obtained in the Create OCI Owned Service Role (step 1f).

      • Specific secret permission: The following example shows the permissions to add to the custom role:

        
        {
            "Version": "2012-10-17",
            "Statement": [
                {
                    "Sid": "VisualEditor0",
                    "Effect": "Allow",
                    "Action": [
                        "secretsmanager:GetSecretValue",
                        "secretsmanager:DescribeSecret"
                    ],
                    "Resource": "arn:aws:secretsmanager:us-east-1:XXXXXXXXXXXX:secret:xx-adbs-secret1-xxxxxx"
                }
            ]
        }

   3. Select Next.
   
4. In the Name, review and create section, enter the following information:
   1. Provide a role name. The name can be up to 64 characters. You can use alphanumeric and (+ = , . @ - _) characters.
   2. Enter a description to add a short explanation for this role. This step is optional.
   3. Review your information, and then select the Create role button.