The execution role is required to use this feature. This allows the container agent to pull the container image. For more information, see AWS Batch IAM execution role.
To provide access to the secrets that you create, add the following permissions as an inline policy to the execution role. For more information, see Adding and Removing IAM Policies.
-
secretsmanager:GetSecretValue -
kms:Decrypt—Required only if your key uses a custom KMS key and not the default key. The Amazon Resource Name (ARN) for your custom key must be added as a resource.
The following is an example inline policy that adds the permissions.
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"kms:Decrypt",
"secretsmanager:GetSecretValue"
],
"Resource": [
"arn:aws:secretsmanager:region:123456789012:secret:secret_name",
"arn:aws:kms:region:123456789012:key/key_id"
]
}
]
}