Can't edit the IAM role? Lock down AWS Secrets Manager with Terraform's aws_secretsmanager_secret_policy for genuine least-privilege access control.