ReadonlyarnARN of the Secrets Manager secret holding the data source credentials. Used both as the QuickSight data source credential and to scope the IAM read grant on the QuickSight Secrets Manager role.
Use cases: Redshift service-user credentials secret
AWS: Secrets Manager secret ARN
Validation: Required
Optional ReadonlykmsKMS key ARNs encrypting the secret. QuickSight's Secrets Manager role is granted decrypt on these so it can read a customer-managed-key-encrypted secret.
Use cases: Decrypting a CMK-encrypted credentials secret
AWS: IAM kms:Decrypt permission on the QuickSight Secrets Manager role
Validation: Optional; required only for CMK-encrypted secrets
Secrets Manager authentication configuration for a QuickSight data source.
Use cases: Authenticating a Redshift data source with a stored secret instead of IAM
AWS: Secrets Manager secret consumed by QuickSight, read via the QuickSight SM role
Validation:
arnis required;kmsKeyArnsis required only if the secret is encrypted with a customer-managed KMS key