title: AWS secret manager access deny issue
body: <p>I have a secret key (USRFTP) stored in ACCOUNT A, I want to access this key from EC2 box with role ASHISHROLE in ACCOUNT B. I am running python code to get secret key as given below, Using resource policy in secret key as given below, KMS policy is as given below, But still getting this issue</p>
  <p>botocore.exceptions.ClientError: An error occurred (AccessDeniedException) when calling the GetSecretValue operation: User: arn:aws:sts::ACCOUNTB:assumed-role/ASHISHROLE /i-*********is not authorized to perform: secretsmanager:GetSecretValue on resource: arn:aws:secretsmanager:us-east-2:ACCOUNTA:secret:USRFTP-KJHJH</p>
  <pre><code>    import boto3
      import base64
      from botocore.exceptions import ClientError
      def get_secret():
          secret_name = &quot;arn:aws:secretsmanager:us-east-2:ACCOUNTA:secret:USRFTP&quot;
          region_name = &quot;us-east-2&quot;
          # Create a Secrets Manager client
          session = boto3.session.Session()
          client = session.client(
              service_name='secretsmanager',
              region_name=region_name
          )
          print(&quot;here&quot;)
  
          get_secret_value_response = client.get_secret_value(
              SecretId=secret_name
          )
          if 'SecretString' in get_secret_value_response:
              return  get_secret_value_response['SecretString']
          else:
              return  base64.b64decode(get_secret_value_response['SecretBinary'])
      
      print(get_secret())
  
  SECRET KEY RESOURCE POLICY
    
  
   {
    &quot;Version&quot; : &quot;2012-10-17&quot;,
    &quot;Statement&quot; : [ {
      &quot;Effect&quot; : &quot;Allow&quot;,
      &quot;Principal&quot; : {
        &quot;AWS&quot; : &quot;arn:aws:iam::ACCOUNTB:role/ASHISHROLE&quot;
      },
      &quot;Action&quot; : &quot;secretsmanager:GetSecretValue&quot;,
      &quot;Resource&quot; : &quot;*&quot;
    } ]
  }
  
  KMS POLICY
  
      {
          &quot;Id&quot;: &quot;key-consolepolicy-3&quot;,
          &quot;Version&quot;: &quot;2012-10-17&quot;,
          &quot;Statement&quot;: [
              {
                  &quot;Sid&quot;: &quot;Enable IAM User Permissions&quot;,
                  &quot;Effect&quot;: &quot;Allow&quot;,
                  &quot;Principal&quot;: {
                      &quot;AWS&quot;: &quot;arn:aws:iam::ACCOUNTA:root&quot;
                  },
                  &quot;Action&quot;: &quot;kms:*&quot;,
                  &quot;Resource&quot;: &quot;*&quot;
              },
              {
                  &quot;Sid&quot;: &quot;Allow access for Key Administrators&quot;,
                  &quot;Effect&quot;: &quot;Allow&quot;,
                  &quot;Principal&quot;: {
                      &quot;AWS&quot;: &quot;arn:aws:iam::ACCOUNTA:role/OKin&quot;
                  },
                  &quot;Action&quot;: [
                      &quot;kms:Create*&quot;,
                      &quot;kms:Describe*&quot;,
                      &quot;kms:Enable*&quot;,
                      &quot;kms:List*&quot;,
                      &quot;kms:Put*&quot;,
                      &quot;kms:Update*&quot;,
                      &quot;kms:Revoke*&quot;,
                      &quot;kms:Disable*&quot;,
                      &quot;kms:Get*&quot;,
                      &quot;kms:Delete*&quot;,
                      &quot;kms:TagResource&quot;,
                      &quot;kms:UntagResource&quot;,
                      &quot;kms:ScheduleKeyDeletion&quot;,
                      &quot;kms:CancelKeyDeletion&quot;
                  ],
                  &quot;Resource&quot;: &quot;*&quot;
              },
              {
                  &quot;Sid&quot;: &quot;Allow use of the key&quot;,
                  &quot;Effect&quot;: &quot;Allow&quot;,
                  &quot;Principal&quot;: {
                      &quot;AWS&quot;: &quot;arn:aws:iam::ACCOUNTB:root&quot;
                  },
                  &quot;Action&quot;: [
                      &quot;kms:Encrypt&quot;,
                      &quot;kms:Decrypt&quot;,
                      &quot;kms:ReEncrypt*&quot;,
                      &quot;kms:GenerateDataKey*&quot;,
                      &quot;kms:DescribeKey&quot;
                  ],
                  &quot;Resource&quot;: &quot;*&quot;
              },
              {
                  &quot;Sid&quot;: &quot;Allow attachment of persistent resources&quot;,
                  &quot;Effect&quot;: &quot;Allow&quot;,
                  &quot;Principal&quot;: {
                      &quot;AWS&quot;: &quot;arn:aws:iam::ACCOUNTB:root&quot;
                  },
                  &quot;Action&quot;: [
                      &quot;kms:CreateGrant&quot;,
                      &quot;kms:ListGrants&quot;,
                      &quot;kms:RevokeGrant&quot;
                  ],
                  &quot;Resource&quot;: &quot;*&quot;,
                  &quot;Condition&quot;: {
                      &quot;Bool&quot;: {
                          &quot;kms:GrantIsForAWSResource&quot;: &quot;true&quot;
                      }
                  }
              }
          ]
      }
  </code></pre>