Configure AWS Secrets Manager Permissions

To use this integration, you must provide AWS IAM credentials (access key ID and secret access key, optionally with a session token) for an IAM identity that is permitted to read the target secret(s).

Before you begin:

Ensure that your IAM identity is permitted to read the following:

• secretsmanager:GetSecretValue — required for every secret the integration reads.

• kms:Decrypt — required only if the secret is encrypted with a customer-managed AWS KMS key (not required when the secret uses the default AWS-managed aws/secretsmanager key).

To configure the required AWS IAM permissions:

1. Create a dedicated IAM identity. In the AWS IAM console, create an IAM user (or assumable role) dedicated to Tenable scans.

   Note: Tenable recommends a dedicated identity so that integration activity is auditable and can be revoked independently.

2. Attach a least-privilege policy. Attach an IAM policy granting secretsmanager:GetSecretValue on the ARN of each secret to be read.

   Note: Use ARN wildcards (for example, arn:aws:secretsmanager:us-east-1:123456789012:secret:tenable/*) if you want to grant access to a group of secrets without listing them individually. If the secret uses a customer-managed AWS KMS key, also grant kms:Decrypt on that key's ARN.

3. Generate access credentials. Generate an access key ID and secret access key for the IAM user, or use AWS STS (aws sts get-session-token or aws sts assume-role) to obtain temporary credentials and supply the resulting session token in the AWS Session Token field of the credential.

   Note: Refer to the AWS Identity and Access Management documentation for full details.