title: Secrets Manage: Fail to rotate the secret, cannot invoke the specified Lambda function
body: <p>Error: <strong>Secrets Manager cannot invoke the specified Lambda function. Ensure that the function policy grants access to the principal secretsmanager.amazonaws.com</strong></p>
  
  <p>I'm using Secret Manager to store my key for verifying JWTs.<br/>
  My planned configuration is to rotate deprecate the keys with the following logic:</p>
  
  <p>my secret looks like this:</p>
  
  <pre><code>{
    current:'my-current-secret',
    previous:'my-previous-secret',
    alg:'encoding alg',
  }
  </code></pre>
  
  <p>*It seemed like overkill to use two secrets and rotating them -- I'm only keeping a memory of the <code>previous</code> token to handle fringe cases for a hand-off. If auth fails I'll check if it verifies with the <code>previous</code>, if it does it'll return an updated cookie using the <code>current</code> key</p>
  
  <p>createSecret:</p>
  
  <pre><code>putSecretValue({
        current: getRandomPassword(...),
        previous: getSecretValue(...)['current'],
        alg: env.param ? env.param : getSecretValue(...)['alg']
  })
  </code></pre>
  
  <p>I'm not using <code>setSecret</code>, <code>testSecret</code>, <code>finishSecret</code></p>
  
  <p>I'm not using serverless (I will at some point, but I wanted to familiarize myself w/ AWS/GUI first before short-cutting w/ the CLI)
  I've looked at:</p>
  
  <ul>
  <li><a href="https://stackoverflow.com/questions/57118962/how-do-i-grant-a-rotation-lambda-access-to-aws-secrets-manager">How do I grant a rotation Lambda access to AWS Secrets Manager</a></li>
  <li><a href="https://docs.aws.amazon.com/secretsmanager/latest/userguide/rotating-secrets-create-generic-template.html" rel="noreferrer">https://docs.aws.amazon.com/secretsmanager/latest/userguide/rotating-secrets-create-generic-template.html</a></li>
  </ul>
  
  <p>I can't figure out what IAM setting I'm missing.</p>
  
  <p>When I try to set the rotation lambda:
  <a href="https://i.stack.imgur.com/1Alur.png" rel="noreferrer"><img src="https://i.stack.imgur.com/1Alur.png" alt="add rotation"></a></p>
  
  <p>This flashes (So quickly, I had to record my screen to take a look):
  <a href="https://i.stack.imgur.com/D5Pqx.png" rel="noreferrer"><img src="https://i.stack.imgur.com/D5Pqx.png" alt="false hope"></a></p>
  
  <p>And I immediately get the following error:
  <a href="https://i.stack.imgur.com/ebuSJ.png" rel="noreferrer"><img src="https://i.stack.imgur.com/ebuSJ.png" alt="error msg"></a></p>
  
  <p>I started by giving the lambda full control of <code>secrets manager</code> and <code>lambdas</code> to work backwards into minimal controls, but even throwing the kitchen sink at it I couldn't get it to work:</p>
  
  <pre><code>{
    "permissionsBoundary": {},
    "roleName": "secrets_manager-role-REDACTED",
    "policies": [
      {
        "document": {
          "Version": "2012-10-17",
          "Statement": [
            {
              "Sid": "VisualEditor0",
              "Effect": "Allow",
              "Action": [
                "secretsmanager:GetRandomPassword",
                "secretsmanager:CreateSecret",
                "secretsmanager:ListSecrets"
              ],
              "Resource": "*"
            },
            {
              "Sid": "VisualEditor1",
              "Effect": "Allow",
              "Action": "secretsmanager:*",
              "Resource": "arn:aws:secretsmanager:us-east-1:REDACTED:secret:REDACTED"
            }
          ]
        },
        "name": "ReadWriteREDACTEDSecret",
        "id": "REDACTED",
        "type": "managed",
        "arn": "arn:aws:iam::REDACTED:policy/ReadWriteREDACTEDSecret"
      },
      {
        "document": {
          "Version": "2012-10-17",
          "Statement": [
            {
              "Sid": "VisualEditor0",
              "Effect": "Allow",
              "Action": [
                "lambda:InvokeFunction",
                "lambda:InvokeAsync"
              ],
              "Resource": "arn:aws:lambda:us-east-1:REDACTED:function:secrets_manager"
            }
          ]
        },
        "name": "invoke_secrets_manager_lambda",
        "id": "REDACTED",
        "type": "managed",
        "arn": "arn:aws:iam::REDACTED:policy/invoke_secrets_manager_lambda"
      },
      {
        "document": {
          "Version": "2012-10-17",
          "Statement": [
            {
              "Effect": "Allow",
              "Action": "logs:CreateLogGroup",
              "Resource": "arn:aws:logs:us-east-1:REDACTED:*"
            },
            {
              "Effect": "Allow",
              "Action": [
                "logs:CreateLogStream",
                "logs:PutLogEvents"
              ],
              "Resource": [
                "arn:aws:logs:us-east-1:REDACTED:log-group:/aws/lambda/secrets_manager:*"
              ]
            }
          ]
        },
        "name": "AWSLambdaBasicExecutionRole-REDACTED",
        "id": "REDACTED",
        "type": "managed",
        "arn": "arn:aws:iam::REDACTED:policy/service-role/AWSLambdaBasicExecutionRole-REDACTED"
      },
      {
        "document": {
          "Version": "2012-10-17",
          "Statement": [
            {
              "Effect": "Allow",
              "Action": [
                "cloudformation:DescribeChangeSet",
                "cloudformation:DescribeStackResources",
                "cloudformation:DescribeStacks",
                "cloudformation:GetTemplate",
                "cloudformation:ListStackResources",
                "cloudwatch:*",
                "cognito-identity:ListIdentityPools",
                "cognito-sync:GetCognitoEvents",
                "cognito-sync:SetCognitoEvents",
                "dynamodb:*",
                "ec2:DescribeSecurityGroups",
                "ec2:DescribeSubnets",
                "ec2:DescribeVpcs",
                "events:*",
                "iam:GetPolicy",
                "iam:GetPolicyVersion",
                "iam:GetRole",
                "iam:GetRolePolicy",
                "iam:ListAttachedRolePolicies",
                "iam:ListRolePolicies",
                "iam:ListRoles",
                "iam:PassRole",
                "iot:AttachPrincipalPolicy",
                "iot:AttachThingPrincipal",
                "iot:CreateKeysAndCertificate",
                "iot:CreatePolicy",
                "iot:CreateThing",
                "iot:CreateTopicRule",
                "iot:DescribeEndpoint",
                "iot:GetTopicRule",
                "iot:ListPolicies",
                "iot:ListThings",
                "iot:ListTopicRules",
                "iot:ReplaceTopicRule",
                "kinesis:DescribeStream",
                "kinesis:ListStreams",
                "kinesis:PutRecord",
                "kms:ListAliases",
                "lambda:*",
                "logs:*",
                "s3:*",
                "sns:ListSubscriptions",
                "sns:ListSubscriptionsByTopic",
                "sns:ListTopics",
                "sns:Publish",
                "sns:Subscribe",
                "sns:Unsubscribe",
                "sqs:ListQueues",
                "sqs:SendMessage",
                "tag:GetResources",
                "xray:PutTelemetryRecords",
                "xray:PutTraceSegments"
              ],
              "Resource": "*"
            }
          ]
        },
        "name": "AWSLambdaFullAccess",
        "id": "REDACTED",
        "type": "managed",
        "arn": "arn:aws:iam::aws:policy/AWSLambdaFullAccess"
      }
    ],
    "trustedEntities": [
      "secretsmanager.amazonaws.com",
      "lambda.amazonaws.com"
    ]
  }
  </code></pre>
  
  <p>My lambda trust policy is as follows:</p>
  
  <pre><code>{
    "Version": "2012-10-17",
    "Statement": [
      {
        "Effect": "Allow",
        "Principal": {
          "Service": [
            "secretsmanager.amazonaws.com",
            "lambda.amazonaws.com"
          ]
        },
        "Action": "sts:AssumeRole"
      }
    ]
  }
  </code></pre>