AWS Secrets Manager Agent adds pre-fetching and IAM role assumption
The AWS Secrets Manager Agent now supports pre-fetching secrets at startup and assuming IAM roles for retrieval. These features reduce application latency, optimize costs by using the BatchGetSecretValue API, and enhance security through role-based cross-account access. The updates are available in all AWS Regions where Secrets Manager is offered and benefit developers managing secrets in multi-account architectures.
- →Pre-fetch secrets at agent startup
- →Assume IAM role for secret retrieval
- →Improved security and operational efficiency
- →Availability and further details
Features (2) ›
- Pre-fetch secrets at agent startup
The AWS Secrets Manager Agent can now pre-fetch a list of secrets or secrets tagged with a specific value at agent startup. This reduces application startup latency and optimizes costs by enabling batch operations for secret retrieval.
- Assume IAM role for secret retrieval
The agent supports assuming an IAM role specified in the pre-fetch configuration or HTTP requests. This allows for cross-account secret retrieval by assuming a role in a different account, simplifying multi-account architectures.
Enhancements (1) ›
- Improved security and operational efficiency
These enhancements strengthen security by enabling role-based secret access and reduce operational overhead by eliminating custom pre-loading logic. IAM role assumption simplifies managing secrets across different accounts by allowing a specific role per secret.
Notes (1) ›
- Availability and further details
The AWS Secrets Manager Agent with these new capabilities is available in all AWS Regions where AWS Secrets Manager is offered. Further details can be found in the AWS Secrets Manager Agent documentation.
https://aws.amazon.com/about-aws/whats-new/2026/05/secrets-manager-agent-prefetch-and-role-assumption/
Related releases
- SageMaker Unified Studio Enhances Git Version Control Across Project Tools AWS What's New ·
- IAM Policy Simulator integrated into IAM console with new features AWS What's New ·
- AWS IAM Identity Center adds multi-Region replication for its own directory AWS What's New ·
- Amazon EKS supports AWS PrivateLink for OIDC endpoint AWS What's New ·
- Amazon Neptune adds IAM tag-based access control for data plane operations AWS What's New ·
- Amazon Bedrock AgentCore enables unified observability for AI agents AWS What's New ·