# Fetch Secrets Manager secret cross account

**URL:** <https://forum.serverless.com/t/fetch-secrets-manager-secret-cross-account/16398>\
**Category:** Serverless Framework\
**Tags:** aws, cloudformation\
**Created:** [December 13, 2021, 10:12pm UTC](https://forum.serverless.com/t/fetch-secrets-manager-secret-cross-account/16398 "2021-12-13T22:12:25Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![ddss](https://avatars.discourse-cdn.com/v4/letter/d/f9ae1b/32.png) [@ddss](https://forum.serverless.com/u/ddss)\
**Post date:** [December 13, 2021, 10:12pm UTC](https://forum.serverless.com/t/fetch-secrets-manager-secret-cross-account/16398/1 "2021-12-13T22:12:25Z")

</div>

Hi,  
I’m having two accounts, let’s call them A and B.  
In account A I have a secret in Secrets Manager. I would like to read this secret in account B’s serverless’ file.

**If only one account** I’m populating environment variables in my serverless.yml file in this way:  
`custom: secrets: ${ssm:/aws/reference/secretsmanager/test-secret-in-account-A}`  
I then populate an environment variable using:  
`provider: environment: AUTH_TOKEN: ${self:custom.secrets.token}`  
This works perfectly if all within one account. **But** how can I read a Secrets Manager secret hosted in account A in account B?  
Thank you!

---

<div class="post-metadata">

**Author:** ![mdial89f](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/mdial89f/32/6888_2.png) [@mdial89f](https://forum.serverless.com/u/mdial89f)\
**Post date:** [May 31, 2022, 11:28am UTC](https://forum.serverless.com/t/fetch-secrets-manager-secret-cross-account/16398/2 "2022-05-31T11:28:29Z")

</div>

Hey ddss,

This functionality of fetching secrets manager data via SSM is an AWS feature, not a Serverless feature. See docs here: [Referencing AWS Secrets Manager secrets from Parameter Store parameters - AWS Systems Manager](https://docs.aws.amazon.com/systems-manager/latest/userguide/integration-ps-secretsmanager.html)

So the question is, will AWS let you reference a cross account parameter, probably by full arn, using the /aws/reference/ syntax… when I try, it doesn’t work. I wish I could! Let me know if you got around this

---

<div class="post-metadata">

**Author:** ![peralmq](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/peralmq/32/7711_2.png) [@peralmq](https://forum.serverless.com/u/peralmq)\
**Post date:** [November 2, 2023, 10:35am UTC](https://forum.serverless.com/t/fetch-secrets-manager-secret-cross-account/16398/3 "2023-11-02T10:35:39Z")

</div>

This is related to the ongoing discussion here that looks like it’s leading to the introduction of a new serverless keyword `secretsmanager:/` to handle cross account secrets manager access. [AWS: Get secrets manager output from another account · Issue #8771 · serverless/serverless · GitHub](https://github.com/serverless/serverless/issues/8771)