Grant a Compute Service Access to a Secrets Manager Secret

Your compute service (Lambda, EC2, or ECS) is connected to a Secrets Manager secret, but its IAM role has no secretsmanager:* permissions. The template deploys, but GetSecretValue fails at runtime with AccessDeniedException. Reading a secret needs secretsmanager:GetSecretValue scoped to the secret ARN. On the canvas, the compute→secret edge generates this automatically; the manual steps are below.

Paste into this field

IAM Role → permissions policy (or draw the edge on the canvas)

Output looks like

Canvas edge: Lambda → Secrets Manager (auto-generates a secretsmanager:GetSecretValue policy)

1Option A (recommended) — let CloudStack Canvas generate it

Without a custom IAM Role node, draw the compute→secret edge and the auto-created role receives a GetSecretValue policy scoped to that secret. Re-export to clear the warning.

3Option B — fix the role in the AWS console and accept the warning

If you manage your own IAM Role node on the canvas, the validation warning will persist in CSC even after you add the policy in AWS. The warning is advisory — it alerts you that the canvas role node lacks these permissions. Add the policy below in AWS, and the template will deploy correctly; the canvas warning remains until you edit the canvas-based role definition.

5Paste a scoped policy

Secret ARNs end in a random 6-character suffix (e.g. -AbCdEf). Use the full ARN, or append -?????? as a wildcard for the suffix as shown. Replace REGION, ACCOUNT, and the secret name.

{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Action": [
      "secretsmanager:GetSecretValue",
      "secretsmanager:DescribeSecret"
    ],
    "Resource": "arn:aws:secretsmanager:REGION:ACCOUNT:secret:my-secret-??????"
  }]
}

8Save the policy

Name it AllowSecretsAccess and click "Create policy". If the secret uses a customer-managed KMS key, also grant kms:Decrypt on that key.

Once you have the value, go back to CloudStack Canvas and paste it into the highlighted field.

CloudStack Canvas · Validation Guide