Sharing AWS Secrets Manager with another account is not working - amazon-web-services

Question

I need to share an AWS Secrets Manager secret with multiple accounts.
For this public post, I've scrubbed the account numbers and replaced them with dummy values.
For this example, the account holding the secret is 987654 and it needs to be accessed by account 123456
The account that will "read" the secret (123456) should be able to read from "ANY ROLE" within the account.
Note: I tried using a wildcard in the principal (ex: "arn:aws:iam::123456:role/*") but I got a malformed policy error. So I'm using conditionals.
The secret is using a KMS key with the following policy:
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "",
"Effect": "Allow",
"Principal": {
"AWS": [
"arn:aws:iam::987654:role/Admin1",
"arn:aws:iam::987654:role/Terraform"
]
},
"Action": "kms:*",
"Resource": "*"
},
{
"Sid": "",
"Effect": "Allow",
"Principal": {
"AWS": "*"
},
"Action": "kms:Decrypt",
"Resource": "*",
"Condition": {
"StringEquals": {
"kms:CallerAccount": [
"987654",
"123456"
]
}
}
}
]
}
The secret policy:
{
"Version" : "2012-10-17",
"Statement" : [ {
"Sid" : "",
"Effect" : "Allow",
"Principal" : {
"AWS" : "*"
},
"Action" : "secretsmanager:GetSecretValue",
"Resource" : "*",
"Condition" : {
"StringEquals" : {
"aws:SourceAccount" : [ "987654", "123456" ]
}
}
} ]
}
When reading the key from account 987654 it works fine. When I try to read the secret from role in account 123456 I get AccessDeniedException:
An error occurred (AccessDeniedException) when calling the GetSecretValue operation: User: arn:aws:sts::123456:assumed-role/Admin/sessionfoo is not authorized to perform: secretsmanager:GetSecretValue on resource: arn:aws:secretsmanager:us-east-1:987654:secret:test because no resource-based policy allows the secretsmanager:GetSecretValue action
I am testing with:
aws secretsmanager get-secret-value --secret-id 'arn:aws:secretsmanager:us-east-1:987654:secret:test'
What's wrong with my policies? Thanks!