Secret Manager Access

This feature is available on:

AWS Managed Cluster
GCP Managed Cluster

Supported Secrets Providers:

AWS Secrets Manager
AWS Parameter Store
GCP Secret Manager

How it works

Qovery integrates with external secrets by deploying ESO (External Secrets Operator) in your cluster.

Configure a Secret Manager Access

You can configure a Secret Manager Access in the “Add-ons” section of your cluster.

Creating or Editing a Secret Manager Access requires the cluster to be redeployed

Configure your AWS Managed Cluster

AWS Authentication

You can use the following authentication methods to use either AWS Secrets Manager or AWS Parameter Store:

AWS Automatic Authentication
AWS Role ARN
AWS Static Credentials

This authentication gives you access to all secrets located in the same AWS account as your cluster.

AWS Automatic & AWS Role authentications are mutually exclusive.

This is the simplest and quickest way to use your external secrets inside your services.The following information is required:

The target AWS Region where your secrets live
The secret manager access name

Qovery automatically creates an AWS IAM Role with the following permissions:

IAM permissions details for AWS Secrets Manager

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "secretsmanager:GetResourcePolicy",
        "secretsmanager:GetSecretValue",
        "secretsmanager:DescribeSecret",
        "secretsmanager:ListSecretVersionIds"
      ],
      "Resource": "*"
    }
  ]
}

IAM permissions details for AWS Parameter Store

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ssm:GetParameter",
        "ssm:GetParameters",
        "ssm:GetParametersByPath",
        "ssm:DescribeParameters"
      ],
      "Resource": "*"
    }
  ]
}

You must create the AWS Role in the same AWS account as your cluster.

AWS Automatic & AWS Role authentications are mutually exclusive.

Creating your own AWS Role lets you control which secrets are accessible.The following information is required:

The target AWS Region where your secrets live
Your AWS Role ARN
The secret manager access name

Use our CloudFormation stack to create the AWS Role

Use our CloudFormation stack to create the AWS Role with the necessary permissions.

Setup Steps:

Open CloudFormation: click on the link “Cloudformation stack”
- This opens AWS CloudFormation in a new tab (login to AWS if needed)
In AWS CloudFormation Console:
- Click Next (template is pre-filled with Qovery’s requirements)
- Stack name: Keep default qovery-secrets-manager-role-creation or customize
- Parameters:
  - OIDCProviderURL: this is your cluster OIDC Provider URL automatically filled, no need to edit it
  - RoleName: this is the name of the IAM Role that will be created, keep default or customize
- ✅ Important: Check “I acknowledge that AWS CloudFormation might create IAM resources”
- Click Create stack
Wait for completion (~1 minute):
- Status changes: CREATE_IN_PROGRESS → CREATE_COMPLETE
- Refresh page if needed
Get the Role ARN:
- Click on the Outputs tab
- Find RoleARN key
- Copy the value

You can edit the permissions attached to the created role to restrict access to your secrets as you wish (see below):

For AWS Secrets Manager

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "secretsmanager:GetResourcePolicy",
        "secretsmanager:GetSecretValue",
        "secretsmanager:DescribeSecret",
        "secretsmanager:ListSecretVersionIds",
        "secretsmanager:ListSecrets"
      ],
      "Resource": "*"
    }
  ]
}

You can restrict access to specific resources using wildcards.However, secretsmanager:ListSecrets must always target Resource: "*" — AWS does not support resource-level restrictions for this action. Without it, Qovery cannot list available secrets when configuring an external secret.Example:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "secretsmanager:GetResourcePolicy",
        "secretsmanager:GetSecretValue",
        "secretsmanager:DescribeSecret",
        "secretsmanager:ListSecretVersionIds"
      ],
      "Resource": "arn:aws:secretsmanager:eu-west-3:XXXXXXXXXXXX:secret:staging*"
   },
   {
     "Effect": "Allow",
     "Action": [
       "secretsmanager:ListSecrets"
     ],
     "Resource": "*"
   }
 ]
}

For AWS Parameter Store

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ssm:GetParameter",
        "ssm:GetParameters",
        "ssm:GetParametersByPath",
        "ssm:DescribeParameters"
      ],
      "Resource": "*"
    }
  ]
}

You can restrict access to specific resources using wildcards.However, ssm:DescribeParameters must always target Resource: "*" — AWS does not support resource-level restrictions for this action. Without it, Qovery cannot list available parameters when configuring an external secret.Example:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ssm:GetParameter",
        "ssm:GetParameters",
        "ssm:GetParametersByPath"
      ],
      "Resource": "arn:aws:ssm:eu-west-3:XXXXXXXXXXXX:parameter/staging*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "ssm:DescribeParameters"
      ],
      "Resource": "*"
    }
  ]
}

The following information is required:

Your AWS Access Key
Your AWS Secret Access Key
The target AWS Region where your secrets live
The secret manager access name

You need to configure the following permissions:

For AWS Secrets Manager

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "secretsmanager:GetResourcePolicy",
        "secretsmanager:GetSecretValue",
        "secretsmanager:DescribeSecret",
        "secretsmanager:ListSecretVersionIds",
        "secretsmanager:ListSecrets"
      ],
      "Resource": "*"
    }
  ]
}

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "secretsmanager:GetResourcePolicy",
        "secretsmanager:GetSecretValue",
        "secretsmanager:DescribeSecret",
        "secretsmanager:ListSecretVersionIds"
      ],
      "Resource": "arn:aws:secretsmanager:eu-west-3:XXXXXXXXXXXX:secret:staging*"
   },
   {
     "Effect": "Allow",
     "Action": [
       "secretsmanager:ListSecrets"
     ],
     "Resource": "*"
   }
 ]
}

For AWS Parameter Store

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ssm:GetParameter",
        "ssm:GetParameters",
        "ssm:GetParametersByPath",
        "ssm:DescribeParameters"
      ],
      "Resource": "*"
    }
  ]
}

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ssm:GetParameter",
        "ssm:GetParameters",
        "ssm:GetParametersByPath"
      ],
      "Resource": "arn:aws:ssm:eu-west-3:XXXXXXXXXXXX:parameter/staging*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "ssm:DescribeParameters"
      ],
      "Resource": "*"
    }
  ]
}

Cross-Cloud Authentication (AWS Cluster → GCP)

You can target the following Secrets Providers using static credentials:

GCP Secret Manager

Qovery provides the following script to run in your GCP Console:

curl https://setup.qovery.com/create_secret_manager_credentials_gcp.sh | \
bash -s -- $GOOGLE_CLOUD_PROJECT qovery_secrets_manager_role qovery-secrets-manager-sa

The following information is required:

The key.json generated
Your GCP Project ID
The target GCP Region where your secrets live
The secret manager access name

Configure your GCP Managed Cluster

GCP Automatic Authentication
GCP Static credentials

This authentication gives you access to all secrets located in the same GCP account as your cluster.

You must add the Secret Manager Viewer role to the GCP service account associated with your Qovery cluster.

Qovery automatically creates the GCP IAM Service Account with the necessary permissions.The following information is required:

Your GCP Project ID
The target GCP Region where your secrets live
The secret manager access name

Automatic GCP Secret Manager authentication

Qovery provides the following script to run in your GCP Console:

curl https://setup.qovery.com/create_secret_manager_credentials_gcp.sh | \
bash -s -- $GOOGLE_CLOUD_PROJECT qovery_secrets_manager_role qovery-secrets-manager-sa

The following information is required:

The key.json generated
Your GCP Project ID
The target GCP Region where your secrets live
The secret manager access name

Cross-Cloud Authentication (GCP Cluster → AWS)

AWS Secrets Manager & Parameter Store

The following information is required:

Your AWS Access Key
Your AWS Secret Access Key
The target AWS Region where your secrets live
The secret manager access name

You need to configure the following permissions:

For AWS Secrets Manager

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "secretsmanager:GetResourcePolicy",
        "secretsmanager:GetSecretValue",
        "secretsmanager:DescribeSecret",
        "secretsmanager:ListSecretVersionIds",
        "secretsmanager:ListSecrets"
      ],
      "Resource": "*"
    }
  ]
}

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "secretsmanager:GetResourcePolicy",
        "secretsmanager:GetSecretValue",
        "secretsmanager:DescribeSecret",
        "secretsmanager:ListSecretVersionIds"
      ],
      "Resource": "arn:aws:secretsmanager:eu-west-3:XXXXXXXXXXXX:secret:staging*"
   },
   {
     "Effect": "Allow",
     "Action": [
       "secretsmanager:ListSecrets"
     ],
     "Resource": "*"
   }
 ]
}

For AWS Parameter Store

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ssm:GetParameter",
        "ssm:GetParameters",
        "ssm:GetParametersByPath",
        "ssm:DescribeParameters"
      ],
      "Resource": "*"
    }
  ]
}

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ssm:GetParameter",
        "ssm:GetParameters",
        "ssm:GetParametersByPath"
      ],
      "Resource": "arn:aws:ssm:eu-west-3:XXXXXXXXXXXX:parameter/staging*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "ssm:DescribeParameters"
      ],
      "Resource": "*"
    }
  ]
}

Reference the external secrets in your service

Once your cluster is deployed, you can link external secrets to any service:

Open your service
Navigate to the Variables tab
Select the External secrets tab
Click Add external secret

Qovery automatically lists the secrets available in your Secrets Provider to simplify setup:

You can filter results by prefix to narrow the list:

External Secrets list secrets available by prefix

To create an external secret, you need to:

Select the Secret Manager Access
Select the secret from your Secret Manager
Provide the environment variable key to inject

Particular case: Terraform Service

Documentation coming soon.

​How it works

​Configure a Secret Manager Access

​Configure your AWS Managed Cluster

​AWS Authentication

​Use our CloudFormation stack to create the AWS Role

​Cross-Cloud Authentication (AWS Cluster → GCP)

​Configure your GCP Managed Cluster

​Cross-Cloud Authentication (GCP Cluster → AWS)

​Reference the external secrets in your service

​Particular case: Terraform Service

How it works

Configure a Secret Manager Access

Configure your AWS Managed Cluster

AWS Authentication

Use our CloudFormation stack to create the AWS Role

Cross-Cloud Authentication (AWS Cluster → GCP)

Configure your GCP Managed Cluster

Cross-Cloud Authentication (GCP Cluster → AWS)

Reference the external secrets in your service

Particular case: Terraform Service