## TL;DR
A failing `describe-secret` call is almost always one of four things: wrong region, wrong secret name or ARN, missing IAM permission, or a KMS key the caller cannot use. Check them in that order and the call succeeds. The fix is configuration, not the secret value.

## Error
```text
aws secretsmanager describe-secret value [redacted]
```

## Steps
1. Verify the region: run `aws configure get region` and confirm the secret actually lives in that region in the console. Expected: the region matches; if not, add `--region` with the correct one and retry.
2. Verify the identifier: run `aws secretsmanager list-secrets` and confirm the exact name or full ARN you are passing. Expected: the name or ARN matches character for character, including any path prefix.
3. Check IAM: ensure the caller identity has `secretsmanager:DescribeSecret` on the secret (test with the IAM policy simulator or a minimal CLI call). Expected: an explicit allow, not just an assumption from a broad policy.
4. Check KMS: if the secret uses a customer-managed key, the caller also needs `kms:Decrypt` (and often `kms:DescribeKey`) on that key. Expected: the key policy grants the caller; describe-secret succeeds once it does.
5. Check for deletion: a secret pending deletion returns an error too. Run `aws secretsmanager describe-secret` and look for a `DeletedDate` in the output of a list call. Expected: no deletion marker; if one exists, restore the secret or recreate it.

## When to use
- `describe-secret` (or any Secrets Manager read) fails from CLI, SDK, or an agent
- A deployment works in one region or account but not another
- After a key rotation, reads start failing

## When not to use
- `put-secret-value` validation errors (different API, different rules)
- Rotation stuck in pending (rotation state machine, not read permissions)
- Application caching a stale value (client-side caching)

## Tool compatibility
- AWS CLI v2, AWS Secrets Manager API (`describe-secret`, `list-secrets`); IAM and KMS console

## Variant phrasings
### ResourceNotFoundException on describe-secret
The name, ARN, or region is wrong, or the secret is pending deletion. Verify all three before touching IAM.

### AccessDenied on secretsmanager read
The caller lacks `secretsmanager:DescribeSecret` or `kms:Decrypt` on the custom key. Add the grants and retry.

## Why it happens
Secrets Manager sits behind two gates: IAM for the API action and KMS for the encryption key. A call can clear the first gate and still fail at the second, and multi-region or multi-account setups make it easy to address the wrong secret in the wrong region.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_TEu1CxySpLyxfI8YLwoTBw