<p>I am trying out external secrets operator (ESO) by following below:</p>
<p><a href="https://github.com/external-secrets/external-secrets" rel="nofollow noreferrer">https://github.com/external-secrets/external-secrets</a></p>
<p><a href="https://external-secrets.io/guides-getting-started/" rel="nofollow noreferrer">https://external-secrets.io/guides-getting-started/</a></p>
<p>I am using minikube and AWS secrets manager to do this (I also tried it out in k8s cluster hosted in EC2, but I get the same exact error).</p>
<p>I followed the steps from the links above:</p>
<ol>
<li>Added the repo:</li>
</ol>
<p><code>helm repo add external-secrets https://charts.external-secrets.io</code></p>
<ol start="2">
<li>Install it in the namespace. I'm already inside of the namespace, so I didn't create the namespace.</li>
</ol>
<p><code>helm install external-secrets external-secrets/external-secrets --set installCRDs=true</code></p>
<ol start="3">
<li>Added k8s secret:</li>
</ol>
<p><code>k create secret generic aws-credentials --from-literal=aws-access-key-id='xxx'  --from-literal=aws-secret-access-key='xxx'</code></p>
<ol start="4">
<li>I created a secret in AWS secrets manager called <em>test_user_1</em></li>
<li>kubectl apply -f secret-store.yaml</li>
</ol>
<pre><code>kind: SecretStore
metadata:
  name: secretstore-sample
spec:
  provider:
    aws:
      service: SecretsManager
      role: arn:aws:iam::123456789012:role/somerole
      region: us-east-1
      auth:
        secretRef:
          accessKeyIDSecretRef:
            name: aws-credentials
            key: aws-access-key-id
          secretAccessKeySecretRef:
            name: aws-credentials
            key: aws-secret-access-key
</code></pre>
<ol start="6">
<li>kubectl apply -f externalsecrets.yaml</li>
</ol>
<pre><code>apiVersion: external-secrets.io/v1alpha1
kind: ExternalSecret
metadata:
  name: example
spec:
  refreshInterval: 1h
  secretStoreRef:
    name: secretstore-sample
    kind: SecretStore
  target:
    name: secret-to-be-created
    creationPolicy: Owner
  data:
    - secretKey: user-1-username
      remoteRef:
        key: test_user_1
        property: username
    - secretKey: user-1-password
      remoteRef:
        key: test_user_1
        property: password
</code></pre>
<p>Then it says</p>
<p><code>externalsecret.external-secrets.io/example created</code></p>
<p>When I do</p>
<p><code>kubectl describe externalsecret.external-secrets.io/example</code></p>
<p>Below is what I get and no <em>secret-to-be-created</em> is created:</p>
<pre><code>...
Status:
  Conditions:
    Last Transition Time:  2021-06-09T22:45:10Z
    Message:               could not get secret data from provider: key &quot;test_user_1&quot; from ExternalSecret &quot;example&quot;: InvalidClientTokenId: The security token included in the request is invalid.
                           status code: 403, request id: 5a544aa0-3953-4c0d-9dab-37bde10e328b
    Reason:                SecretSyncedError
    Status:                False
    Type:                  Ready
  Refresh Time:            &lt;nil&gt;
Events:                    &lt;none&gt;

</code></pre>
<p>I know this role has access to aws secrets manager (I've run python scripts to access aws secrets manager from my laptop using this role). But, I have limited knowledge of k8s, so, I appreciate any help.</p>

wi3o
<p>I solved the issue. It's on AWS side. I needed to create a new user and a new role. Put the newly created role in the <em>role:</em> section of the configmap and allow the user to assume that role by providing the aws creds for the user as environment variables in the k8s cluster.</p>
<p>Put this policy for the newly created role:</p>
<pre><code>{
  &quot;Version&quot;: &quot;2012-10-17&quot;,
  &quot;Statement&quot;: [
    {
      &quot;Effect&quot;: &quot;Allow&quot;,
      &quot;Action&quot;: [
        &quot;secretsmanager:GetResourcePolicy&quot;,
        &quot;secretsmanager:GetSecretValue&quot;,
        &quot;secretsmanager:DescribeSecret&quot;,
        &quot;secretsmanager:ListSecretVersionIds&quot;
      ],
      &quot;Resource&quot;: [
        &quot;arn:aws:secretsmanager:us-west-2:111122223333:secret:dev-*&quot;,
      ]
    }
  ]
}
</code></pre>
<p>And below as the trust relationship for the role:</p>
<pre><code>{
  &quot;Version&quot;: &quot;2012-10-17&quot;,
  &quot;Statement&quot;: [
    {
      &quot;Effect&quot;: &quot;Allow&quot;,
      &quot;Principal&quot;: {
        &quot;AWS&quot;: &quot;arn:aws:iam::...&quot;
      },
      &quot;Action&quot;: &quot;sts:AssumeRole&quot;
    }
  ]
}
</code></pre>
<p>Below policy for the newly created user:</p>
<pre><code>{
    &quot;Version&quot;: &quot;2012-10-17&quot;,
    &quot;Statement&quot;: {
        &quot;Effect&quot;: &quot;Allow&quot;,
        &quot;Action&quot;: &quot;sts:AssumeRole&quot;,
        &quot;Resource&quot;: &quot;arn:aws:iam::....&quot;
    }
}
</code></pre>
