Skip to main content

​
AWS Secrets Manager Prerequisites

Complete these steps in the AWS console before configuring the integration in Prizm.

​
What you need

  • An AWS account with Secrets Manager enabled
  • IAM permissions to create policies and users
  • The AWS Region where your secrets are stored (e.g., us-east-1)

​
Step 1 — Store your connector secrets in AWS Secrets Manager

If you have not already stored your connector credentials in Secrets Manager, do so now. In the AWS console, navigate to Secrets Manager → Store a new secret. Use a consistent path prefix (e.g., prizm/) for all secrets Prizm will access, such as prizm/snowflake-prod/password. This simplifies the IAM policy — a single wildcard ARN covers all Prizm secrets. For the secret value, you can use:
  • Plaintext: a single string (e.g., a password)
  • Key/value pairs: a JSON object (e.g., {"password": "abc123", "username": "prizmuser"})
Note the Secret name — you will reference it when configuring connectors in Prizm.

​
Step 2 — Create an IAM policy

In the AWS console, navigate to IAM → Policies → Create policy. Select the JSON editor and enter:
Adjust the Resource ARN to match your secret path prefix. Click Next, give the policy a name (e.g., PrizmSecretsReadAccess), and click Create policy.

​
Step 3 — Create an IAM user

In the AWS console, navigate to IAM → Users → Create user.
  • User name: prizm-secrets-reader (or similar)
  • Permissions: Attach the policy created in Step 2 directly
  • Click Create user

​
Step 4 — Generate access keys

On the IAM user detail page, navigate to Security credentials → Create access key.
  • Use case: Select Application running outside AWS
  • Click Next, then Create access key
  • Copy the Access Key ID and Secret Access Key
The Secret Access Key is shown only once. Store it securely before closing the page.
IAM access keys should be rotated regularly. When you rotate the key, update the values in Prizm before deactivating the old key to avoid connector failures. If Prizm is deployed within your AWS environment, consider using an IAM role instead — role-based credentials rotate automatically without manual key management.

​
Summary — values needed for Prizm

Setup

Enter the above values in Prizm to complete the integration.