title: Restrict access to ressources from AWS Secrets Manager to a group
body: <p>I have in my AWS Secrets Manager a few keys that need to be accessed from a EC2 instance using the command :
  <code>aws secretsmanager get-secret-value --secret-id Test/Dev-key</code></p>
  <p>I have created a IAM user that will only be used for this purpose and created a IAM group to apply the SecretManagerPolicy that I created. I want to this user to only have access to the key having <code>Test/</code> in their names. So here is the policy I've made :</p>
  <pre><code>{
      &quot;Version&quot;: &quot;2012-10-17&quot;,
      &quot;Statement&quot;: [
          {
              &quot;Sid&quot;: &quot;VisualEditor0&quot;,
              &quot;Effect&quot;: &quot;Allow&quot;,
              &quot;Action&quot;: &quot;secretsmanager:*&quot;,
              &quot;Resource&quot;: &quot;arn:aws:secretsmanager:*:*:secret:Test/*&quot;
          }
      ]
  }
  </code></pre>
  <p>My user cannot access to any keys or list them. If I replace the Resource field with the full arn of a secret I can list all of them.</p>
  <p>I also tried to add a condition using tags but I still can list secrets without the tag.</p>
  <p>It's either I can access all secrets or none.</p>