title: Glue Job Cross-Account secret access failing despite policies
body: <p><em>Note: I have reviewed other questions and believe this is unique because it specifically pertains to cross-account secrets access using a glue job.</em></p>
  <p>I am having an issue where a glue job, assuming a service role in one account, is unable to access a secret stored in another account, despite my policies which I believe should allow it to do so.</p>
  <p>Error I'm seeing (with redacted values): <code>An error occurred (AccessDeniedException) when calling the GetSecretValue operation: Access to KMS is not allowed. This version of secret is not encrypted with the current KMS key.</code></p>
  <h2 id="question-28kc">Question</h2>
  <p>What about the below setup is causing the permission failure?</p>
  <h2 id="diagram-of-current-situation-da3t">Diagram of Current Situation</h2>
  <p><a href="https://i.stack.imgur.com/JvDNf.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/JvDNf.png" alt="enter image description here" /></a></p>
  <h2 id="my-understanding-of-what-needs-to-be-done-cwsr">My Understanding of What Needs to be Done</h2>
  <p>Based on <a href="https://aws.amazon.com/premiumsupport/knowledge-center/secrets-manager-share-between-accounts/" rel="nofollow noreferrer">the AWS docs</a> and a <a href="https://aws.amazon.com/blogs/security/how-to-access-secrets-across-aws-accounts-by-attaching-resource-based-policies/" rel="nofollow noreferrer">2018 blog post</a>, I think what we have to do is:</p>
  <ul>
  <li>Add a Policy on the secret to allow access to service role</li>
  <li>Add a Policy on the CMK to allow service role to decrypt</li>
  <li>Add a Policy on Service role to allow access to secret</li>
  <li>Add a Policy on Service role to allow CMK decryption</li>
  </ul>
  <h2 id="current-policies-0gda">Current Policies</h2>
  <h3 id="policy-on-secret-7vh6">Policy on Secret</h3>
  <pre class="lang-json prettyprint-override"><code>{
    &quot;Version&quot; : &quot;2012-10-17&quot;,
    &quot;Statement&quot; : [ {
      &quot;Effect&quot; : &quot;Allow&quot;,
      &quot;Principal&quot; : {
        &quot;AWS&quot; : &quot;arn:aws:iam::GLUE_ACCOUNT:role/GLUE_SERVICE_ROLE&quot;
      },
      &quot;Action&quot; : &quot;secretsmanager:GetSecretValue&quot;,
      &quot;Resource&quot; : &quot;*&quot;,
      &quot;Condition&quot; : {  
        &quot;ForAnyValue:StringEquals&quot; : {
          &quot;secretsmanager:VersionStage&quot; : &quot;AWSCURRENT&quot;
        }
      }
    } ]
  }
  </code></pre>
  <h3 id="policy-on-cmk-brvv">Policy on CMK</h3>
  <p>Note that the redacted <code>SECRET_NAME</code> below contains the few characters that AWS appends in the ARN, which it seems we need to include.</p>
  <pre class="lang-json prettyprint-override"><code>{
      &quot;Sid&quot;: &quot;AllowUseOfTheKey&quot;,
      &quot;Effect&quot;: &quot;Allow&quot;,
      &quot;Principal&quot;: {
          &quot;AWS&quot;: &quot;arn:aws:iam::GLUE_ACCOUNT:role/GLUE_SERVICE_ROLE&quot;
      },
      &quot;Action&quot;: [&quot;kms:Decrypt&quot;,&quot;kms:DescribeKey&quot;], 
      &quot;Resource&quot;: &quot;*&quot;,
      &quot;Condition&quot;: {
          &quot;StringEquals&quot;: {
              &quot;kms:ViaService&quot;: &quot;secretsmanager.us-east-1.amazonaws.com&quot;
          },
          &quot;StringLike&quot;: {
              &quot;kms:EncryptionContext:SecretARN&quot;: &quot;arn:aws:secretsmanager:us-east-1:SECRET_ACCOUNT:secret:SECRET_NAME&quot;
          }
      }
  }
  </code></pre>
  <h3 id="policy-statements-attached-to-glue-service-role-in-glue-account-ckr6">Policy Statements Attached to Glue Service Role in Glue Account</h3>
  <pre class="lang-json prettyprint-override"><code>{
      &quot;Sid&quot;: &quot;AllowGetSecretValue&quot;,
      &quot;Effect&quot;: &quot;Allow&quot;,
      &quot;Action&quot;: [
          &quot;secretsmanager:GetSecretValue&quot;
      ],
      &quot;Resource&quot;: [
          &quot;arn:aws:secretsmanager:us-east-1:SECRET_ACCOUNT:secret:SECRET_NAME&quot;
      ]
  },
  {
      &quot;Sid&quot;: &quot;AllowKMSDecrypt&quot;,
      &quot;Effect&quot;: &quot;Allow&quot;,
      &quot;Action&quot;: [
          &quot;kms:Decrypt&quot;
      ],
      &quot;Resource&quot;: [
          &quot;arn:aws:kms:us-east-1:SECRET_ACCOUNT:key/CMK_KEY_ID&quot;
      ]
  },
  
  </code></pre>
  <h3 id="trust-policy-on-the-service-role-en55">Trust policy on the service role</h3>
  <p>Just to confirm that the glue job does indeed seem to have the authority to assume the service role:</p>
  <pre class="lang-json prettyprint-override"><code>{
    &quot;Version&quot;: &quot;2012-10-17&quot;,
    &quot;Statement&quot;: [
      {
        &quot;Effect&quot;: &quot;Allow&quot;,
        &quot;Principal&quot;: {
          &quot;Service&quot;: &quot;glue.amazonaws.com&quot;
        },
        &quot;Action&quot;: &quot;sts:AssumeRole&quot;
      }
    ]
  }
  </code></pre>
  <h2 id="possible-next-steps-4xn5">Possible Next Steps</h2>
  <p>As thought experiments, I'm considering doing the below just to see if it works:</p>
  <ul>
  <li>Removing the condition in the secret policy</li>
  <li>Removing the conditions in the CMK policy</li>
  <li>Adding <code>kms:DescribeKey</code> to the Service Account policy as well, though I don't think that's going to resolve things.</li>
  </ul>