Available in VPC
You can set different access permissions for Secret Manager using NAVER Cloud Platform's Sub Account service. Sub Account offers system-managed (System Managed) policies to help you configure management and operation permissions.
Sub Account is a free service with no additional charges. For more information about Sub Account, see Services > Management & Governance > Sub Account on the NAVER Cloud Platform portal and the Sub Account user guide.
System-managed policies
System-managed policies are pre-built, role-based policies that NAVER Cloud Platform provides for your convenience. When you assign 1 of these policies to a sub account, that account gets access to Secret Manager. Here are the available system-managed policies for Secret Manager:
| Policy name | Policy description |
|---|---|
| NCP_ADMINISTRATOR | Access to all services with the same scope as the main account |
| NCP_INFRA_MANAGER | Access to all services, except the console's My Account > Manage billing information and expense > Manage billing and payment |
| NCP_FINANCE_MANAGER | Access only to Cost Explorer and the My Account > Manage billing information and expense > Manage billing and payment menu in the console |
| NCP_SECRETMANAGER_USER | Access to the Secret Manager console and the view feature only |
| NCP_SECRETMANAGER_MANAGER | Full access to all Secret Manager features |
User-defined (User Created) policies
User-defined policies let you create custom permissions. When you assign a user-defined policy to a sub account, that account can only perform the specific actions you've allowed. Here are the available user-defined policies for Secret Manager:
If you grant someone access to a specific action but not to the required related actions, they won't be able to complete their tasks. Sub Account automatically includes these related permissions to prevent this issue. However, if you manually uncheck these auto-selected related actions, the system assumes this was intentional and won't override your selection.
Secret actions
| Type | Action | Related action | Resource type | Group by resource type | Action description |
|---|---|---|---|---|---|
| View | getSecretList | - | Secret Manager | View the list of secrets. | |
| View | getSecretDetail | View/getSecretList | Secret | Secret Manager | View secret details. |
| View | getSecretLogs | View/getSecretList, View/getSecretDetail | Secret | Secret Manager | View secret usage logs. |
| View | getSecretValue | View/getSecretList, View/getSecretDetail | Secret | Secret Manager | View a secret chain value. |
| Change | createSecret | View/getSecretList, View/getProtectionKeyList, View/getProtectionKeyDetail, View/getRotationTriggerList, View/getRotationTriggerDetail | - | Secret Manager | Create a new secret. |
| Change | deleteSecret | View/getSecretList, View/getSecretDetail | Secret | Secret Manager | Delete a secret immediately. This action cannot be reversed. |
| Change | enableSecret | View/getSecretList, View/getSecretDetail | Secret | Secret Manager | Enable a secret. |
| Change | disableSecret | View/getSecretList, View/getSecretDetail | Secret | Secret Manager | Disable a secret. |
| Change | requestSecretDeletion | View/getSecretList, View/getSecretDetail | Secret | Secret Manager | Place a secret in the pending deletion state. |
| Change | cancelSecretDeletion | View/getSecretList, View/getSecretDetail | Secret | Secret Manager | Cancel pending deletion of a secret and place it in the disabled state. |
| Change | updateSecretMemo | View/getSecretList, View/getSecretDetail | Secret | Secret Manager | Edit a secret memo. |
| Change | updateProtectionKey | View/getSecretList, View/getSecretDetail, View/getProtectionKeyList, View/getProtectionKeyDetail | Secret | Secret Manager | Change a secret protection key and re-encrypt the secret. |
| Change | updateRotationTrigger | View/getSecretList, View/getSecretDetail, View/getRotationTriggerList, View/getRotationTriggerDetail | Secret | Secret Manager | Change a secret rotation trigger. |
| Change | deleteRotationTrigger | View/getSecretList, View/getSecretDetail. View/getRotationTriggerDetail | Secret | Secret Manager | Remove a secret rotation trigger. |
| Change | updateSecretValue | View/getSecretList, View/getSecretDetail, View/getSecretValue | Secret | Secret Manager | Change a secret chain value. |
| Change | enableAutoRotation | View/getSecretList, View/getSecretDetail | Secret | Secret Manager | Enable automatic secret rotation. |
| Change | disableAutoRotation | View/getSecretList, View/getSecretDetail | Secret | Secret Manager | Disable automatic secret rotation. |
| Change | updateAutoRotationPeriod | View/getSecretList, View/getSecretDetail | Secret | Secret Manager | Change the automatic secret rotation interval. |
| Change | executeRotation | View/getSecretList, View/getSecretDetail, View/getSecretValue | Secret | Secret Manager | Run a secret rotation operation. |
| Change | retryRotation | View/getSecretList, View/getSecretDetail, View/getSecretValue | Secret | Secret Manager | Retry rotation for a secret whose rotation failed. |
| Change | rollbackRotation | View/getSecretList, View/getSecretDetail, View/getSecretValue | Secret | Secret Manager | Roll back a completed secret rotation to restore the previous state. |
| Change | cancelRotation | View/getSecretList, View/getSecretDetail, View/getSecretValue | Secret | Secret Manager | Stop a secret operation that has not yet completed. |
| Change | subscribeProduct | - | - | Secret Manager | Subscribe to Secret Manager. |
| Change | unsubscribeProduct | - | - | Secret Manager | Unsubscribe from Secret Manager. |
Secret protection key actions
| Type | Action | Related action | Resource type | Group by resource type | Action description |
|---|---|---|---|---|---|
| View | getProtectionKeyList | KMS:View/getKeyList | - | Key Management Service | View the list of secret protection keys. |
| View | getProtectionKeyDetail | View/getProtectionKeyList, KMS:View/getKeyInfo, KMS:Change/createKeySubscription | Key | Key Management Service | View secret protection key details. |
Secret rotation trigger actions
| Type | Action | Related action | Resource type | Group by resource type | Action description |
|---|---|---|---|---|---|
| View | getRotationTriggerList | - | Cloud Functions | View the list of triggers that can be designated as secret rotation triggers. | |
| View | getRotationTriggerDetail | View/getRotationTriggerList | Trigger | Cloud Functions | View details of triggers that can be designated as secret rotation triggers. |
| View | getRotationActionList | - | Cloud Functions | View the list of secret rotation actions. | |
| View | getRotationActionDetail | View/getRotationActionList | Action | Cloud Functions | View secret rotation action details. |
| Change | createRotationTrigger | View/getRotationActionList, View/getRotationActionDetail | - | Cloud Functions | Create a secret rotation trigger. |