The External Secrets Inc. Audit & Compliance product suite is a premium product. It requires a specific subscription. Contact us for more information.

​
AWS Secrets Manager Provider

The Audit Listener can be configured to receive audit logs from AWS Secrets Manager by utilizing a SQS queue, Event Bridge and a Cloud Trail. The illustration below demonstrates the setup: Architecture Light Architecture Dark

​
Required Permissions

To setup the Listener, the following permission must be assigned:
  • sqs:ReceiveMessage
  • sqs:DeleteMessage
  • secretsmanager:GetSecretValue
  • secretsmanager:ListSecrets
The GetSecretValue and ListSecrets permissions are necessary for the listener to calculate duplicate entries.

​
Policy Example

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "sqs:ReceiveMessage",
        "sqs:DeleteMessage",
        "sqs:ChangeMessageVisibility"
      ],
      "Resource": "arn:aws:sqs:REGION:ACCOUNT_ID:QUEUE_NAME"
    },
    {
      "Effect": "Allow",
      "Action": [
        "secretsmanager:GetSecretValue"
      ],
      "Resource": "arn:aws:secretsmanager:REGION:ACCOUNT_ID:secret:*"
    }
  ]
}

​
Configuring the Provider

Setting up the provider may require configuration of the authentication methods during the listener installation process.

​
Supported Authentication Methods

The Audit Listener supports the following AWS authentication methods:
  • Using a Access Key and Secret Access Key defined in the runtime.
  • Using an IAM role for tasks when using ECS task definition or the RunTask API operation.
  • Using an IAM role for Amazon EC2 when your is running on an EC2 instance.
  • Using IAM Role for Service Account when running on EKS.

​
Creating a new Provider

After completing the listener setup, you can create a new provider.
  1. Navigate to the Dashboard.
  2. Add a new provider:
    • Select AWS_SECRETS_MANAGER as the provider type.
    • Specify the fields based on your installation:
      • Region: AWS region.
      • QueueURL: SQS queue endpoint URL.

​
Setting Up AWS

  • Create S3 Bucket that will be used to store Cloud Trail logs
  • Create a Trail on Cloud Trail
  • Create SQS queue that will be consumed by Audit Listener
  • Configure Event Bridge to route Secrets Manager events to SQS

​
Create S3 Bucket

data "aws_caller_identity" "current" {}

resource "aws_s3_bucket" "sm_trail_bucket" {
  bucket = "sm-trail-bucket"
}

resource "aws_s3_bucket_policy" "s3_bucket_policy" {
  bucket = aws_s3_bucket.sm_trail_bucket.id
  policy = jsonencode({
    Version = "2012-10-17",
    Statement = [

      {
        Sid       = "AWSCloudTrailAclCheck",
        Effect    = "Allow",
        Principal = { Service = "cloudtrail.amazonaws.com" },
        Action    = "s3:GetBucketAcl",
        Resource  = aws_s3_bucket.sm_trail_bucket.arn
      },
      {
        Sid       = "AWSCloudTrailWrite",
        Effect    = "Allow",
        Principal = { Service = "cloudtrail.amazonaws.com" },
        Action    = "s3:PutObject",
        Resource  = "${aws_s3_bucket.sm_trail_bucket.arn}/AWSLogs/${data.aws_caller_identity.current.account_id}/*"
      }
    ]
  })
}

​
Create Trail

resource "aws_cloudtrail" "cloud_trail" {
  name                          = "sm-trail"
  s3_bucket_name                = aws_s3_bucket.sm_trail_bucket.id
  include_global_service_events = true
  is_multi_region_trail         = true
  enable_log_file_validation    = true
}

​
Create SQS Queue


resource "aws_sqs_queue" "sm_events_queue" {
  name = "secrets_manager_events"
}

data "aws_iam_policy_document" "policy" {
  statement {
    actions   = ["sqs:SendMessage"]
    resources = [aws_sqs_queue.sm_events_queue.arn]
    sid       = "AllowEventBridgeToSendMessages"
    principals {
      type        = "Service"
      identifiers = ["events.amazonaws.com"]
    }
    condition {
      test     = "ArnEquals"
      variable = "aws:SourceArn"
      values   = [aws_cloudwatch_event_rule.sm_events_rule.arn]
    }
    effect = "Allow"
  }
}

resource "aws_sqs_queue_policy" "sqs_policy" {
  queue_url = aws_sqs_queue.sm_events_queue.id

  policy = data.aws_iam_policy_document.policy.json
}

​
Configure Event Bridge

resource "aws_cloudwatch_event_rule" "sm_events_rule" {
  name = "secrets-manager-events-rule"

  event_pattern = jsonencode({
    source      = ["aws.secretsmanager"],
    detail-type = ["AWS API Call via CloudTrail"],
    "detail" : {
      "eventSource" : ["secretsmanager.amazonaws.com"]
    }
  })
  ## For GetSecretValue Logging
  state = "ENABLED_WITH_ALL_CLOUDTRAIL_MANAGEMENT_EVENTS"
}

resource "aws_cloudwatch_event_target" "sqs" {
  rule      = aws_cloudwatch_event_rule.sm_events_rule.name
  target_id = "SendToSQS"
  arn       = aws_sqs_queue.sm_events_queue.arn
}