Why am I getting access denied exception to get a secret when invoking my lambda function even though it has permission?

Viewed 932

When invoking a test for my lambda function in the lambda console I get:

AccessDeniedException: User: arn:aws:sts::xxxxxxxxxxx:assumed-role/role-for-my-lambda-function/some-other-role is not authorized to perform: secretsmanager:GetSecretValue on resource: MyKey

role-for-my-lambda-function is the role I've created and attached to the lamdba function. It contains permission to get the secret value.

I don't know where some-other-role comes from though.

This is the policy:

        - Sid: 'accessSecret'
          Effect: Allow
          Action:
          - 'secretsmanager:GetSecretValue'
          Resource:
          - 'arn:aws:secretsmanager:eu-west-1:xxxxxxxxxx:secret:MyKey-yyyyy'

What is wrong and how should I fix it?

0 Answers
Related