[aws-secretsmanager]: Expose arnForPolicies on ISecret

[Xfel]

Describe the feature

The property arnForPolicies is currently defined protected on SecretBase and used by the grantRead and grantWrite methods. Making this a public property on ISecret simplifies creation of custom policies.

Use Case

The Kubernetes External Secrets operator needs additional actions granted on secrets used, as described here. These are not added when simply using ISecret.grantRead.

However, using the correct ARN for secrets in policies is non-trivial, especially when you aren't sure at the time of writing where the secret in question will come from. CDK internally uses a mechanism to resolve this, but it is not exposed.

Another usecase would be to handle multiple secret resources inside a single policy statement.

Proposed Solution

The logic is already present, it just needs to be made public.

Other Information

No response

Acknowledgements

• I may be able to implement this feature request
• This feature might incur a breaking change

CDK version used

2.99.0

Environment details (OS name and version, etc.)

Windows 10

[pahud]

Thanks for your use case sharing. We probably need more discussion here though I don't see any risk making it public.