Unable to order certificate using shell script in IBM secrets Manager

Question

I am getting the below message frequently while trying to execute the order public certificate api in shell script.

[{"error_message":"api auth request for subject: 'iam-ServiceId-bd8a0d74-82a0-48a3-9315-d940e149931d' action: 'secrets-manager.secret.create' resource 'crn:v1:bluemix:public:secrets-manager:us-south:a/585be4294d421d096580e222f89a3f55:c1576db9-7ceb-4001-a772-a1c5834c21a1:secret-group:a16d54c5-b484-2330-3d41-17085308f885' not permitted. trace: 'c5c03a25-b36f-4626-f21c-13593d0b5761'"}],"errors":[{"code":"secrets-manager.Error04091","message":"api auth request for subject: 'iam-ServiceId-bd8a0d74-82a0-48a3-9315-d940e149931d' action: 'secrets-manager.secret.create' resource 'crn:v1:bluemix:public:secrets-manager:us-south:a/585be4294d421d096580e222f89a3f55:c1576db9-7ceb-4001-a772-a1c5834c21a1:secret-group:a16d54c5-b484-2330-3d41-17085308f885' not permitted. trace: 'c5c03a25-b36f-4626-f21c-13593d0b5761'"}]

Answer 1

You are either missing Writer service access policy on your User or Service ID, or the S2S configuration between Secrets Manager and your DNS provider is is misconfigured (eg Manager is required for CIS).