grantRead on a Secret should also grant DescribeSecret

[jls-tschanzc]

The grantRead method will only give permission for the secretsmanager:GetSecretValue action on a secret and won't also grant permission for the secretsmanager:DescribeSecret action.

This is unintuitive as granting permission for retrieval should also grant permission to read the metadata.

Use Case

Creating an RDS DatabaseInstance will create a DatabaseSecret in the Secrets Manager. This secret can be used by the aws-secretsmanager-jdbc package to connect to the database.

When having e.g. a Spring Boot application running on ECS, you can grant the task role read access to the secret using:

appDB.secret?.grantRead(service.taskDefinition.taskRole);

But this is not enough; the aws-secretsmanager-jdbc package will try to interact with the secret using the secretsmanager:DescribeSecret action as well. So apart from the grantRead above, you will need to attach an inline policy to grant the missing action:

service.taskDefinition.taskRole.attachInlinePolicy(
    new Policy(this, 'DBSecretPolicy', {
      statements: [
        new PolicyStatement({
          effect: Effect.ALLOW,
          resources: [appDB.secret?.secretArn || ''],
          actions: ['secretsmanager:DescribeSecret'],
        }),
      ],
    })
);

Proposed Solution

I would expect grantRead to give full read access to the secret and it's metadata to the specified role. So the grantRead method should grant permissions for both secretsmanager:GetSecretValue and secretsmanager:DescribeSecret.

Otherwise further permission functions like grantReadDescribe might be useful.

Other

• 👋 I may be able to implement this feature request
• ⚠️ This feature might incur a breaking change

---

This is a 🚀 Feature Request