Infisical will assume the provided role in your AWS account securely, without the need to share any credentials.

Prerequisites:

1

Create the Managing User IAM Role for AWS Secrets Manager

  1. Navigate to the Create IAM Role page in your AWS Console.

  2. Select AWS Account as the Trusted Entity Type.

  3. Choose Another AWS Account and enter 381492033652 (Infisical AWS Account ID). This restricts the role to be assumed only by Infisical. If self-hosting, provide your AWS account number instead.

  4. Optionally, enable Require external ID and enter your project ID to further enhance security.

2

Add Required Permissions for the IAM Role

Use the following custom policy to grant the minimum permissions required by Infisical to sync secrets to AWS Secrets Manager:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowSecretsManagerAccess",
      "Effect": "Allow",
      "Action": [
        "secretsmanager:GetSecretValue",
        "secretsmanager:CreateSecret",
        "secretsmanager:UpdateSecret",
        "secretsmanager:DescribeSecret",
        "secretsmanager:TagResource",
        "secretsmanager:UntagResource",
        "kms:ListKeys",
        "kms:ListAliases",
        "kms:Encrypt",
        "kms:Decrypt"
      ],
      "Resource": "*"
    }
  ]
}
3

Copy the AWS IAM Role ARN

4

Authorize Infisical for AWS Secrets Manager

  1. Navigate to your project’s integrations tab in Infisical.

  2. Click on the AWS Secrets Manager tile.

  3. Select the AWS Assume Role option.

  4. Provide the AWS IAM Role ARN obtained from the previous step.

5

Start integration

Select how you want to integration to work by specifying a number of parameters:

​
Project Environment
string
required

The environment in Infisical from which you want to sync secrets to AWS Secrets Manager.

​
Secrets Path
string
required

The path within the preselected environment form which you want to sync secrets to AWS Secrets Manager.

​
AWS Region
string
required

The region that you want to integrate with in AWS Secrets Manager.

​
Mapping Behavior
string
required

How you want the integration to map the secrets. The selected value could be either one to one or one to many.

​
AWS SM Secret Name
string
required

The secret name/path in AWS into which you want to sync the secrets from Infisical.

Optionally, you can add tags or specify the encryption key of all the secrets created via this integration:

​
Tag Sync Mode
string

The sync mode for AWS tags. The supported options are Secret Metadata and Custom. If Secret Metadata is selected, the metadata of the Infisical secrets are used as tags in AWS. If custom is selected, then the key/value of the Secret Tag field is used. Secret Metadata mode is only supported for one-to-one integrations.

​
Secret Tag
string

The Key/Value of a tag that will be added to secrets in AWS. Please note that it is possible to add multiple tags via API.

​
Encryption Key
string

The alias/ID of the AWS KMS key used for encryption. Please note that key should be enabled in order to work and the IAM user should have access to it.

Then, press Create Integration to start syncing secrets to AWS Secrets Manager.

Infisical currently syncs environment variables to AWS Secrets Manager as key-value pairs under one secret. We’re actively exploring ways to help users group environment variable key-pairs under multiple secrets for greater control.

Please note that upon deleting secrets in Infisical, AWS Secrets Manager immediately makes the secrets inaccessible but only schedules them for deletion after at least 7 days.

Was this page helpful?

Suggest editsRaise issue