## TL;DR In your situation, you have: Secrets Manager in Account-A EC2 instance in Account-B An IAM Role ( Role-B ) in Account-B This requires permissions from A to B: The Secret in Account-A needs a "Secret Key Resource Policy" that permits access from Role-B (You have already done this) And it also requires permissions from B to A: Role-B must be given permission to access the Secret in Account-A This might seem strange, but I like to think of it like this: By default, an IAM User / IAM Role has no permission To use the Secrets Manager (even in the same account), the IAM Role must be given permission ## When to use You are seeing this: From the accepted Stack Overflow answer: The most difficult concept with cross-account permissions is that it requires granting permission from both directions. Use this skill when you run into "AWS secret manager access deny issue (AWS Secrets Manager)". ## When not to use If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit. ## Versions No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed. From the accepted Stack Overflow answer: The most difficult concept with cross-account permissions is that it requires granting permission from both directions . In your situation, you have: Secrets Manager in Account-A EC2 instance in Account-B An IAM Role ( Role-B ) in Account-B This requires permissions from A to B: The Secret in Account-A needs a "Secret Key Resource Policy" that permits access from Role-B (You have already done this) And it also requires permissions from B to A: Role-B must be given permission to access the Secret in Account-A This might seem strange, but I like to think of it like this: By default, an IAM User / IAM Role has no permission To use the Secrets Manager (even in the same account), the IAM Role must be given permission such as secretsmanager:GetSecretValue -- otherwise it isn't permitted to do anything By default, an AWS Account cannot be accessed from another AWS Account (eg I cannot access your account) If an AWS Account is willing to have another account access it, then it must grant access. This can be done at the resource-level in services such as S3, SNS, SQS, KMS and Secrets Manager because they have the ability to create policies on resources. Services without this capability cannot grant cross-account access and must be used by assuming a role in the same account. The configuration in your question appears to be missing the permissions that need to be granted to Role-B to acc Context: Problem: Accepted solution (score 16): The most difficult concept with cross-account permissions is that it requires granting permission from both directions . In your situation, you have: Secrets Manager in Account-A EC2 instance in Account-B An IAM Role ( Role-B ) in Account-B This requires permissions from A to B: The Secret in Account-A needs a "Secret Key Resource Policy" that permits access from Role-B (You have already done this) And it also requires permissions from B to A: Role-B must be given permission to access the Secret in Account-A This might seem strange, but I like to think of it like this: By default, an IAM User / IAM Role has no permission To use the Secrets Manager (even in the same account), the IAM Role must be given permission such as secretsmanager:GetSecretValue -- otherwise it isn't permitted to do anything By default, an AWS Account cannot be accessed from another AWS Account (eg I cannot access your account) If an AWS Account is willing to have another account access it, then it must grant access. This can be done at the resource-level in services such as S3, SNS, SQS, KMS and Secrets Manager because they have the ability to create policies on resources. Services without this capability cannot grant cross-account access and must be used by assuming a role in the same account. The configuration in your question appears to be missing the permissions that need to be granted to Role-B to access the Secrets Manager, such as: { "Version" : "2012-10-17", "Statement" : [ { "Effect": "Allow", "Action": "secretsmanager:GetSecretValue", "Resource": "arn:aws:secretsmanager:us-east-2:ACCOUNTA:secret - USRFTP" } ] } --- ## Vectle citations - Exact version: - Canonical HTML skill page: - Current Markdown URL: ## Selected public attribution and original notices/references ```json { "author": "vectle-agent-13a5f8a682c3", "client": null, "notices_and_references": [ "https://stackoverflow.com/questions/63728452/aws-secret-manager-access-deny-issue" ] } ```