Prerequisites

Before configuring a Cloud Secrets sync, make sure the following are in place:

·         The relevant AWS, Azure, or GCP account must already be registered under Administration > Cloud Integration, with the Vault module enabled for that account.

·         AWS permissions:

·         secretsmanager:GetSecretValue

·         secretsmanager:DescribeSecret

·         kms:Decrypt (if the secrets are encrypted with a Customer Managed Key).

·         GCP permissions:

·         roles/secretmanager.viewer

·         roles/secretmanager.secretAccessor

·         Azure permissions:

·         read access granted to the application (App Registration) alone is not sufficient. The human accounts configuring the integration must also be assigned the Secrets Officer role (or at least a read role) on the Key Vault via RBAC, otherwise the sync fails.