So i created this secret, test_secret-Q6dOdK, in Secretsmanager, but i am using an aws federated user which uses a role:
ProdAdmin-Prod-Role/myUsername. the issue is that when i specify the principal like this

{
“Version” : “2012-10-17”,
“Statement” : [ {
“Effect” : “Deny”,
“Principal” : “*”,
“Action” : “secretsmanager:GetSecretValue”,
“Resource” : “arn:aws:secretsmanager:af-south-1:123456789:secret:test_secret-Q6dOdK”,
“Condition” : {
“StringNotLike” : {
“aws:PrincipalArn” : “arn:aws:sts::123456789:assumed-role/ProdAdmin-Prod-Role/myUsername”
}
}
} ]
}

it does not work, it still blocks me from accessing it as well.

How can i specify the principal in such a way that aws will recognize it?

Worth noting that when i remove username after role, it works but everyone with that role is able to access it as well which is not the desirable effect.

I tried this
{
“Version” : “2012-10-17”,
“Statement” : [ {
“Effect” : “Deny”,
“Principal” : “*”,
“Action” : “secretsmanager:GetSecretValue”,
“Resource” : “arn:aws:secretsmanager:af-south-1:123456789:secret:test_secret-Q6dOdK”,
“Condition” : {
“StringNotLike” : {
“aws:PrincipalArn” : “arn:aws:sts::123456789:assumed-role/ProdAdmin-Prod-Role/myUsername”,
“aws:PrincipalArn” : “arn:aws:iam::123456789:role/ProdAdmin-Prod-Role”
}
}
} ]
}

and it did not work, when i just specify the role it makes everyone with the role have access to the key which i do not want