Permission denied when policy restricts to current version of secret about secrets-store-csi-driver-provider-aws HOT 1 CLOSED

The practice of restricting GetSecretValue to only the current version is not considered a best practice. The secret provides access and the privileges are provided by whatever the secret is connected to, such as a database. Either the old passwords are no longer valid or they provide access to the same set privileges (unless someone is repurposing secrets; which is not a good idea). There are also good reasons to let users access previous passwords (e.g. when a database is restored from an old backup).

The use of "secretsmanager:VersionStage" was shown in some of the API documents as an example of how to place restrictions on parameters and was not intended to become a common practice. We are working on replacing these examples in the docs.

from secrets-store-csi-driver-provider-aws.