iampolicy.json

{
  "Version": "2012-10-17",
  "Statement": [
      {
          "Effect": "Allow",
          "Action": [
              "secretsmanager:Describe*",
              "secretsmanager:Get*",
              "secretsmanager:List*" 
          ],
         "Resource": "*",
          "Condition": { "StringEquals": { "secretsmanager:ResourceTag/APP": "devtest", "secretsmanager:ResourceTag/ENV": "Non-Prod" } }
      },
      {
        "Effect": "Allow",
        "Action": [
         "s3:CreateBucket",
          "s3:DeleteBucket",
          "s3:ListBucket",
          "s3:ListBucketVersions",
          "s3:GetObject",
          "s3:PutObject"
        ],
        "Resource": [
          "arn:aws:s3:::devtest-nonprod-*"
        ]
      }
  ]
}