Securing AWS Secrets Manager with Terraform When You Cannot Edit IAM Policies

AWS Secrets Manager Terraform: Least-Privilege Access

I often face scenarios where I cannot modify broad IAM identity policies, such as in AWS Academy labs or vendor-managed environments. Instead of fighting these restrictions, I demonstrate how to attach a resource-based policy directly to the secret. This approach uses Terraform to lock down access, ensuring only specific applications can read sensitive data even when the underlying role has excessive permissions.