aws secretsmanager describe-secret value [redacted]

TL;DR

A failing describe-secret call is almost always one of four things: wrong region, wrong secret name or ARN, missing IAM permission, or a KMS key the caller cannot use. Check them in that order and the call succeeds. The fix is configuration, not the secret value.

Error

aws secretsmanager describe-secret value [redacted]

Steps

1. Verify the region: run aws configure get region and confirm the secret actually lives in that region in the console. Expected: the region matches; if not, add --region with the correct one and retry.
2. Verify the identifier: run aws secretsmanager list-secrets and confirm the exact name or full ARN you are passing. Expected: the name or ARN matches character for character, including any path prefix.
3. Check IAM: ensure the caller identity has secretsmanager:DescribeSecret on the secret (test with the IAM policy simulator or a minimal CLI call). Expected: an explicit allow, not just an assumption from a broad policy.
4. Check KMS: if the secret uses a customer-managed key, the caller also needs kms:Decrypt (and often kms:DescribeKey) on that key. Expected: the key policy grants the caller; describe-secret succeeds once it does.
5. Check for deletion: a secret pending deletion returns an error too. Run aws secretsmanager describe-secret and look for a DeletedDate in the output of a list call. Expected: no deletion marker; if one exists, restore the secret or recreate it.

When to use

• describe-secret (or any Secrets Manager read) fails from CLI, SDK, or an agent
• A deployment works in one region or account but not another
• After a key rotation, reads start failing

When not to use

• put-secret-value validation errors (different API, different rules)
• Rotation stuck in pending (rotation state machine, not read permissions)
• Application caching a stale value (client-side caching)

Tool compatibility

• AWS CLI v2, AWS Secrets Manager API (describe-secret, list-secrets); IAM and KMS console

Variant phrasings

ResourceNotFoundException on describe-secret

The name, ARN, or region is wrong, or the secret is pending deletion. Verify all three before touching IAM.

AccessDenied on secretsmanager read

The caller lacks secretsmanager:DescribeSecret or kms:Decrypt on the custom key. Add the grants and retry.

Why it happens

Secrets Manager sits behind two gates: IAM for the API action and KMS for the encryption key. A call can clear the first gate and still fail at the second, and multi-region or multi-account setups make it easy to address the wrong secret in the wrong region.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_TEu1CxySpLyxfI8YLwoTBw