Unable to create AppRunner instance role for AWS Secrets Manager access

Question

I am trying to create an instance role where AppRunner can reach out to AWS Secrets Manager to retrieve a few secrets. In the "Configure Service" section of the AppRunner setup console, it says I need to copy the following policy template to an IAM role that I would create:

![AppRunner Service Configuration Menu](/media/postImages/original/IMvmA7p9TYSb6lnmul0mjoDg)

But when I head over to the IAM console, I try to create a AWS instance role for AppRunner, but I don't see any "use case" options for AWS AppRunner. I even tried typing in "App Runner" but still no results.

![AppRunner Instance Role](/media/postImages/original/IMqt6cIbfnS-mUX3EmU3Boug)

![No Result for AppRunner](/media/postImages/original/IMWnNdnjIITQ2AOzoNOgnxwQ)

Am I missing something here? Am I instead supposed to create a **"Custom Trust Policy"** , and copy the policy template shown in the first screenshot?

Or was there any other way I can get AppRunner to retrieve credentials from AWS Secrets Manager?

Accepted Answer

Hello.

In that case, select Custom Trust Policy and set the trust policy below.  
https://docs.aws.amazon.com/apprunner/latest/dg/security_iam_service-with-iam.html#security_iam_service-with-iam-roles
```
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "tasks.apprunner.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}
```

After that, set a policy to access the copied secret manager in the IAM policy.

Answer

Hi Riku,

Many thanks for the answer! This worked!

For anyone else that stumbles into a similar issue as I did, here are the steps I did. However, I am not sure if having the 2 permission policies I added are redundant, and I only need one. Nonetheless, AppRunner worked for me after I did these steps:

1. Logged into the IAM console
2. Clicked **"Create role**" button to create new role
![Enter image description here](/media/postImages/original/IMphJz0-k0Soq-Vu-_dgJTWQ)
3. As mentioned, I put the following trust policy in the text area box:

```
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "tasks.apprunner.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}
```

![Enter image description here](/media/postImages/original/IMtb_Z2pY7QSiUkRUROjGJZQ)

4. Clicked the **Next** button

5. I then added the **SecretsManagerReadWrite** permission policy, and clicked the **Next** button
![Enter image description here](/media/postImages/original/IMesNAwRdhR6CV2lyguXRpHQ)

6. Finished creating the role:

![Enter image description here](/media/postImages/original/IMhf6GiERmTjeT4Szy27A0Ow)

![Enter image description here](/media/postImages/original/IM1Qy_dEtITSy8aJxrRsAclg)

7. Went back to the IAM Policy page, and clicked the role I just created which I named **AppRunner-Testing**:

![Enter image description here](/media/postImages/original/IM0bxGuNBBSpCJw8mQyoAYWQ)

8. I then clicked the "Add permissions" button, and select the **Create inline policy** option

![Enter image description here](/media/postImages/original/IMq1AfzyIvRT6sZp7gKr8JDw)

9. Select **Secrets Manager** as the service:

![Enter image description here](/media/postImages/original/IMYUYJ8GHPRK-L0rxznWjn8w)

10. I added all access levels from the **List** and **Read** sections. I left everything else as default, and then clicked the **Next** button:

![Enter image description here](/media/postImages/original/IME4cCxINpSUW7nwrZQOIIVQ)

![Enter image description here](/media/postImages/original/IMEwWkLK08S7efdEnzn8UwvA)

11. I named the inline policy **AppRunner-secrets-read** and clicked the **Create Policy** button:

![Enter image description here](/media/postImages/original/IMlxsdxUWFRiK3LaZDzVFXrA)

12. I view the created role now:

![Enter image description here](/media/postImages/original/IM7yhig-bJT52GC9kAuEft4w)

The content of **AppRunner-secrets-read** permission policy:

```
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "secretsmanager:GetRandomPassword",
                "secretsmanager:GetResourcePolicy",
                "secretsmanager:GetSecretValue",
                "secretsmanager:DescribeSecret",
                "secretsmanager:ListSecretVersionIds",
                "secretsmanager:ListSecrets",
                "secretsmanager:BatchGetSecretValue"
            ],
            "Resource": "*"
        }
    ]
}
```

The content of **SecretsManagerReadWrite** permission policy:

```
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "secretsmanager:*",
                "cloudformation:CreateChangeSet",
                "cloudformation:DescribeChangeSet",
                "cloudformation:DescribeStackResource",
                "cloudformation:DescribeStacks",
                "cloudformation:ExecuteChangeSet",
                "docdb-elastic:GetCluster",
                "docdb-elastic:ListClusters",
                "ec2:DescribeSecurityGroups",
                "ec2:DescribeSubnets",
                "ec2:DescribeVpcs",
                "kms:DescribeKey",
                "kms:ListAliases",
                "kms:ListKeys",
                "lambda:ListFunctions",
                "rds:DescribeDBClusters",
                "rds:DescribeDBInstances",
                "redshift:DescribeClusters",
                "tag:GetResources"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "lambda:AddPermission",
                "lambda:CreateFunction",
                "lambda:GetFunction",
                "lambda:InvokeFunction",
                "lambda:UpdateFunctionConfiguration"
            ],
            "Resource": "arn:aws:lambda:*:*:function:SecretsManager*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "serverlessrepo:CreateCloudFormationChangeSet",
                "serverlessrepo:GetApplication"
            ],
            "Resource": "arn:aws:serverlessrepo:*:*:applications/SecretsManager*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:GetObject"
            ],
            "Resource": [
                "arn:aws:s3:::awsserverlessrepo-changesets*",
                "arn:aws:s3:::secrets-manager-rotation-apps-*/*"
            ]
        }
    ]
}
```

Unable to create AppRunner instance role for AWS Secrets Manager access

Relevant content