Prerequisites for AWS Secrets Manager

This guide outlines the steps to create an IAM role in AWS, grant the minimum required permissions to read secrets from AWS Secrets Manager, and configure the credentials used to authenticate. The collected values map directly to the AWS Secrets Manager provider fields in the Cloud Exchange Secrets Manager UI.

Click play to watch a video.

Create an IAM Role

Begin by creating an IAM role in the AWS account that holds the secrets. This creates the Identity that Cloud Exchange will use.

Use the official AWS Guide for this step: Create an IAM role.

Grant Access to Secrets Manager (Least Privilege)

After the identity exists, grant it permission to read secrets. Use a customer managed policy that allows only secretsmanager:GetSecretValue, which allows reading secret values, but not creating, updating, or deleting them.

1. Go to the IAM console.
2. In the left menu, select Policies.
3. Click Create policy and select the JSON tab.
4. Paste the following policy, replacing <region>, <account-id>, and <secret-name> with the values for the environment.
   

   {
     "Version": "2012-10-17",
     "Statement": [
       {
         "Effect": "Allow",
         "Action": "secretsmanager:GetSecretValue",
         "Resource": [
           "arn:aws:secretsmanager:<region>:<account-id>:secret:<secret-name>-*",
           "arn:aws:secretsmanager:<region>:<account-id>:secret:netskope-ce-validation-probe*"
         ]
       }
     ]
   }

   
   
5. Click Next, enter a policy name (like Netskope CE Secrets Read), and click Create policy.
6. Go to Roles and select the role created in Part 1.
7. Click Add permissions and select Attach policies.
8. Select the policy created above and click Add permissions.

Create a secret on AWS Secrets Manager

1. Sign into your AWS console and select AWS Secrets Manager service. Then click on Store a new Secret button.



2. For secret type, choose Other type of secret. In Key/Value pairs section, enter the Secret Key and Secret value. This Secret Key would be used during plugin configuration. Click Next to proceed.



3. Enter Secret Name in Secret Name and Description section. This Secret Name would be used during plugin configuration. Click Next to proceed.



4. Optionally, setup rotation if required and then click Next to proceed.
5. Finally, review the secret and click Store to store the secret.

Configure Authentication Credentials

Choose one of the following options to authenticate. These values populate the Authentication Method, Region, and credential fields in the Secrets Manager UI.

Option A: Deployed on AWS (Instance or Task Role)

Use this option when Cloud Exchange runs on AWS infrastructure. Credentials are read from the default AWS credential chain, so no keys are entered in Cloud Exchange.

1. Go to the EC2 console and select the instance that runs Cloud Exchange.
2. Click Actions > Security > Modify IAM role.
3. Select the role created in Part 1 and click Update IAM role.
4. In Cloud Exchange, set Authentication Method to Deployed on AWS.
5. Select the Region in which the secrets are stored.

Option B: AWS IAM Roles Anywhere (Certificate-based)

Use this option when Cloud Exchange runs outside AWS. Before proceeding, ensure the X.509 client certificate and its private key are available in PEM format.

1. Go to IAM > Roles Anywhere in the AWS console.
2. Click Create a trust anchor and upload the certificate authority (CA) that issued the client certificate.
3. Record the Trust Anchor ARN.
4. Click Create a profile, select the role created in Part 1, and click Create profile.
5. Record the Profile ARN.
6. Go to Roles, select the role, and open the Trust relationships tab.
7. Click Edit trust policy, paste the following, and click Update policy.
   

   {
     "Version": "2012-10-17",
     "Statement": [
       {
         "Effect": "Allow",
         "Principal": {
           "Service": "rolesanywhere.amazonaws.com"
         },
         "Action": [
           "sts:AssumeRole",
           "sts:TagSession",
           "sts:SetSourceIdentity"
         ]
       }
     ]
   }

8. In Cloud Exchange, set Authentication Method to AWS IAM Roles Anywhere and enter the Profile ARN, Role ARN, Trust Anchor ARN, Certificate Body, and Private Key. Provide the Private Key Passphrase if the private key is encrypted.

Using AWS Secrets Manager’s Secrets in Configuration

After the AWS Secrets Manager is configured, the stored secrets can be used to configure plugins using the Secret ID and Secret Key.

Summary of Required Configuration Params

When completed, the following parameters are required to configure the product: