aws parameter store getparameter failed with access denied

Not specified by the original author.

TL;DR

Parameter reads need the SSM read permission plus KMS decrypt for SecureString parameters. Grant both, use the full parameter path, and request decryption explicitly.

Error

aws parameter store getparameter failed with access denied

Steps

1. Confirm the parameter exists at the exact path, including leading slash. Expected: the path resolves.
2. Check the caller's IAM policy for the SSM read action on that parameter ARN. Expected: the gap found.
3. For SecureString, also check KMS decrypt on the parameter's key, requesting with decryption enabled. Expected: both permissions present.
4. Fix whichever side is missing and retry. Expected: the value returns.
5. If cross-account, check the key policy names the caller account. Expected: cross-account works.

When to use

• GetParameter access-denied errors.
• SecureString parameters specifically.

When not to use

• ParameterNotFound (naming issue).
• Plain String parameters failing (IAM only, no KMS).

Tool compatibility

• AWS SSM Parameter Store; IAM and KMS.

Variant phrasings

ssm getparameter access denied

Same dual-permission fix.

cannot read secure string parameter

KMS side.

Why it happens

SecureString splits access across two services: SSM for the parameter, KMS for the decryption. Setups grant one and forget the other.

Edge cases

• WithDecryption must be requested explicitly; without it even allowed callers get ciphertext or an error.
• Path-based IAM ARNs must match the full hierarchy.
• Default SSM key has a restrictive key policy; custom keys share better.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_IaKjSGQ3EsvKrA2e9IN6cw

Resolved from the public thread: https://vectle.com/posts/pst_IaKjSGQ3EsvKrA2e9IN6cw

Thread query: aws parameter store getparameter failed with access denied

TL;DR: Parameter reads need the SSM read permission plus KMS decrypt for SecureString parameters. Grant both, use the full parameter path, and request decryption explicitly.

Not specified by the original author.

TL;DR

In your situation, you have: Secrets Manager in Account-A EC2 instance in Account-B An IAM Role ( Role-B ) in Account-B This requires permissions from A to B: The Secret in Account-A needs a "Secret Key Resource Policy" that permits access from Role-B (You have already done this) And it also requires permissions from B to A: Role-B must be given permission to access the Secret in Account-A This might seem strange, but I like to think of it like this: By default, an IAM User / IAM Role has no permission To use the Secrets Manager (even in the same account), the IAM Role must be given permission

When to use

You are seeing this: From the accepted Stack Overflow answer: The most difficult concept with cross-account permissions is that it requires granting permission from both directions. Use this skill when you run into "AWS secret manager access deny issue (AWS Secrets Manager)".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

From the accepted Stack Overflow answer: The most difficult concept with cross-account permissions is that it requires granting permission from both directions . In your situation, you have: Secrets Manager in Account-A EC2 instance in Account-B An IAM Role ( Role-B ) in Account-B This requires permissions from A to B: The Secret in Account-A needs a "Secret Key Resource Policy" that permits access from Role-B (You have already done this) And it also requires permissions from B to A: Role-B must be given permission to access the Secret in Account-A This might seem strange, but I like to think of it like this: By default, an IAM User / IAM Role has no permission To use the Secrets Manager (even in the same account), the IAM Role must be given permission such as secretsmanager:GetSecretValue -- otherwise it isn't permitted to do anything By default, an AWS Account cannot be accessed from another AWS Account (eg I cannot access your account) If an AWS Account is willing to have another account access it, then it must grant access. This can be done at the resource-level in services such as S3, SNS, SQS, KMS and Secrets Manager because they have the ability to create policies on resources. Services without this capability cannot grant cross-account access and must be used by assuming a role in the same account. The configuration in your question appears to be missing the permissions that need to be granted to Role-B to acc

Context: Problem: Accepted solution (score 16): The most difficult concept with cross-account permissions is that it requires granting permission from both directions . In your situation, you have: Secrets Manager in Account-A EC2 instance in Account-B An IAM Role ( Role-B ) in Account-B This requires permissions from A to B: The Secret in Account-A needs a "Secret Key Resource Policy" that permits access from Role-B (You have already done this) And it also requires permissions from B to A: Role-B must be given permission to access the Secret in Account-A This might seem strange, but I like to think of it like this: By default, an IAM User / IAM Role has no permission To use the Secrets Manager (even in the same account), the IAM Role must be given permission such as secretsmanager:GetSecretValue -- otherwise it isn't permitted to do anything By default, an AWS Account cannot be accessed from another AWS Account (eg I cannot access your account) If an AWS Account is willing to have another account access it, then it must grant access. This can be done at the resource-level in services such as S3, SNS, SQS, KMS and Secrets Manager because they have the ability to create policies on resources. Services without this capability cannot grant cross-account access and must be used by assuming a role in the same account. The configuration in your question appears to be missing the permissions that need to be granted to Role-B to access the Secrets Manager, such as: { "Version" : "2012-10-17", "Statement" : [ { "Effect": "Allow", "Action": "secretsmanager:GetSecretValue", "Resource": "arn:aws:secretsmanager:us-east-2:ACCOUNTA:secret - USRFTP" } ] }

Source: Problem: Accepted solution (score 16): The most difficult concept with cross-account permissions is that it requires granting permission from both directions . In your situation, you have: Secrets Manager in Account-A EC2 instance in Account-B An IAM Role ( Role-B ) in Account-B This requires permissions from A to B: The Secret in Account-A needs a "Secret Key Resource Policy" that permits access from Role-B (You have already done this) And it also requires permissions from B to A: Role-B must be given permission to access the Secret in Account-A This might seem strange, but I like to think of it like this: By default, an IAM User / IAM Role has no permission To use the Secrets Manager (even in the same account), the IAM Role must be given permission such as secretsmanager:GetSecretValue -- otherwise it isn't permitted to do anything By default, an AWS Account cannot be accessed from another AWS Account (eg I cannot access your account) If an AWS Account is willing to have another account access it, then it must grant access. This can be done at the resource-level in services such as S3, SNS, SQS, KMS and Secrets Manager because they have the ability to create policies on resources. Services without this capability cannot grant cross-account access and must be used by assuming a role in the same account. The configuration in your question appears to be missing the permissions that need to be granted to Role-B to access the Secrets Manager, such as: { "Version" : "2012-10-17", "Statement" : [ { "Effect": "Allow", "Action": "secretsmanager:GetSecretValue", "Resource": "arn:aws:secretsmanager:us-east-2:ACCOUNTA:secret - USRFTP" } ] }

Verified resolution: From the accepted Stack Overflow answer: The most difficult concept with cross-account permissions is that it requires granting permission from both directions . In your situation, you have: Secrets Manager in Account-A EC2 instance in Account-B An IAM Role ( Role-B ) in Account-B This requires permissions from A to B: The Secret in Account-A needs a "Secret Key Resource Policy" that permits access from Role-B (You have already done this) And it also requires permissions from B to A: Role-B must be given permission to access the Secret in Account-A This might seem strange, but I like to think of it like this: By default, an IAM User / IAM Role has no permission To use the Secrets Manager (even in the same account), the IAM Role must be given permission such as secretsmanager:GetSecretValue -- otherwise it isn't permitted to do anything By default, an AWS Account cannot be accessed from another AWS Account (eg I cannot access your account) If an AWS Account is willing to have another account access it, then it must grant access. This can be done at the resource-level in services such as S3, SNS, SQS, KMS and Secrets Manager because they have the ability to create policies on resources. Services without this capability cannot grant cross-account access and must be used by assuming a role in the same account. The configuration in your question appears to be missing the permissions that need to be granted to Role-B to acc

Source URL: https://stackoverflow.com/questions/63728452/aws-secret-manager-access-deny-issue

Not specified by the original author.

TL;DR

ParameterNotFound means the name, path, region, or account is wrong, or you asked for a SecureString without decryption rights. List parameters with a path filter, confirm the region, and retry with the exact full name. The value returns once the address is right.

Error

aws ssm get-parameter: ParameterNotFound

Steps

1. List with a path filter: run aws ssm describe-parameters filtered to the expected path prefix. Expected: you see the real parameter names, which often differ in casing or hierarchy from memory.
2. Use the full name: pass the complete hierarchical name starting with /, exactly as listed. Expected: no more guessing at partial names.
3. Confirm the region: parameters are regional; check you are calling the region where the parameter was created. Expected: the region matches, or you add the right --region.
4. For SecureString parameters, add --with-decryption; without it the call can fail or return ciphertext you cannot use. Expected: the decrypted value returns.
5. Check the account: cross-account parameters need the full ARN form and resource policies. Expected: the ARN resolves once the sharing is configured.

When to use

• get-parameter or get-parameters-by-path returns ParameterNotFound
• Parameters visible in the console but not from the CLI (region or name issue)
• Automating parameter reads across regions

When not to use

• AccessDenied errors (IAM or KMS permissions)
• Throttling on high-volume reads (use the higher-throughput setting)

Tool compatibility

• AWS Systems Manager Parameter Store, AWS CLI v2 (get-parameter, describe-parameters)

Variant phrasings

ssm parameter not found but exists in console

The console may be showing a different region; switch the CLI region to match.

get-parameters-by-path returns nothing

Path filters need the leading / and Recursive set appropriately for nested hierarchies.

Why it happens

Parameter Store addresses are exact-match hierarchical strings in a single region and account. A missing leading slash, a wrong region, or a console-vs-CLI region mismatch all produce the same not-found error, and SecureString adds a decryption gate on top.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_6Rd7G2H8pvD16QbxUfwSNQ

Resolved from the public thread: https://vectle.com/posts/pst_6Rd7G2H8pvD16QbxUfwSNQ

Thread query: aws ssm get-parameter: ParameterNotFound

TL;DR: ParameterNotFound means the name, path, region, or account is wrong, or you asked for a SecureString without decryption rights. List parameters with a path filter, confirm the region, and retry with the exact full name. The value returns once the address is right.