Vault applications only need the GetSecretValue permissions; therefore, the permission

boundary for Vault applications is as follows:

{

"Version": "2012-10-17",

"Statement": [

{

"Sid": "AllowGetSecretsOnlyInPath",

"Effect": "Allow",

"Action": [

"secretsmanager:GetSecretValue",

],

"Resource": "arn:aws:secretsmanager:{REGION}:{ACCOUNT_ID}:secret:{TM_IAM_PREFIX}/*"

},

}