Secrets Hub ListSecrets Only CloudFormation Template

SecretsHubDiscoveryONLY.json

{
    "AWSTemplateFormatVersion": "2010-09-09",
    "Parameters": {
        "PolicyName": {
            "Type": "String",
            "Description": "Meaningful policy name"
        },
        "CyberArkSecretsHubRoleARN": {
            "Type": "String",
            "Description": "The Secrets Hub tenant role ARN which will be trusted by this role"
        },
        "SecretsManagerRegion": {
            "Type": "String",
            "Description": "The AWS Secrets Manager Account region that the Secrets Hub will have access to"
        }
    },
    "Resources": {
        "AllowSecretsAccessRole": {
            "Type": "AWS::IAM::Role",
            "Properties": {
                "AssumeRolePolicyDocument": {
                    "Version": "2012-10-17",
                    "Statement": [
                        {
                            "Effect": "Allow",
                            "Principal": {
                                "AWS": {
                                    "Ref": "CyberArkSecretsHubRoleARN"
                                }
                            },
                            "Action": [
                                "sts:AssumeRole"
                            ]
                        }
                    ]
                },
                "Policies": [
                    {
                        "PolicyName": {
                            "Ref": "PolicyName"
                        },
                        "PolicyDocument": {
                            "Version": "2012-10-17",
                            "Statement": [
                                {
                                    "Action": "secretsmanager:ListSecrets",
                                    "Resource": "*",
                                    "Effect": "Allow",
                                    "Condition": {
                                        "StringEquals": {
                                            "aws:RequestedRegion": {
                                                "Ref": "SecretsManagerRegion"
                                            }
                                        }
                                    }
                                }
                            ]
                        }
                    }
                ]
            }
        }
    }
}