Repository: cloud-custodian/cloud-custodian

Issue:
Secrets Manager - Add delete Secret action
### Describe the feature

I want to be able to delete old secrets that haven't been accessed in over 90 days as a security policy to eliminate risk. There currently is no action for delete but there is a boto3 API for it - https://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/secretsmanager.html#SecretsManager.Client.delete_secret

This would be handy for cleanups

### Extra information or context

```
- name: aws-secrets-delete-unused
  resource: aws.secrets-manager
  description: Deletes Secrets that haven't been accessed in over 90 days.
  filters:
   - type: value
     key: LastAccessedDate
     value_type: age
     op: gt
     value: 90
  actions:
    - type: delete
```

Discussion:
PratMis: I can go ahead and add the action to remove cross-account statements to this PR, as per the requirement in #7647 
PratMis: > I can go ahead and add the action to remove-statements to this PR, as per the requirement in #7647
Added, should be ready for review. Thanks

Patch:
diff --git a/c7n/resources/secretsmanager.py b/c7n/resources/secretsmanager.py
index 0a08fbfa6..38533a63e 100644
--- a/c7n/resources/secretsmanager.py
+++ b/c7n/resources/secretsmanager.py
@@ -1,6 +1,11 @@
 # Copyright The Cloud Custodian Authors.
 # SPDX-License-Identifier: Apache-2.0
+import json
+import jmespath
 from c7n.manager import resources
+from c7n.actions import BaseAction, RemovePolicyBase
+from c7n.exceptions import PolicyValidationError
+from c7n.utils import type_schema
 from c7n.filters import iamaccess
 from c7n.query import QueryResourceManager, TypeInfo
 from c7n.filters.kms import KmsRelatedFilter
@@ -137,3 +142,96 @@ class MarkSecretForOp(TagDelayedAction):
                   op: tag
                   days: 1
     """
+
+
+@SecretsManager.action_registry.register('delete')
+class DeleteSecretsManager(BaseAction):
+    """Delete a secret and all of its versions.
+    The recovery window is the number of days from 7 to 30 that
+    Secrets Manager waits before permanently deleting the secret
+    with default as 30
+
+    :example:
+
+    .. code-block:: yaml
+
+            policies:
+              - name: delete-cross-account-secrets
+                resource: aws.secrets-manager
+                filters:
+                  - type: cross-account
+                actions:
+                  - type: delete
+                    recovery_window: 10
+    """
+
+    schema = type_schema('delete', recovery_window={'type': 'integer'})
+    permissions = ('secretsmanager:DeleteSecret',)
+
+    def process(self, resources):
+        client = local_session(
+            self.manager.session_factory).client('secretsmanager')
+
+        for r in resources:
+            if 'ReplicationStatus' in r:
+                rep_regions = jmespath.search('ReplicationStatus[*].Region', r)
+                self.manager.retry(client.remove_regions_from_replication,
+                  SecretId=r['ARN'], RemoveReplicaRegions=rep_regions)
+            self.manager.retry(client.delete_secret,
+              SecretId=r['ARN'], RecoveryWindowInDays=self.data.get('recovery_window', 30))
+
+
+@SecretsManager.action_registry.register('remove-statements')
+class SecretsManagerRemovePolicyStatement(RemovePolicyBase):
+    """
+    Action to remove resource based policy statements from secrets manager
+
+    :example:
+
+    .. code-block:: yaml
+
+        policies:
+          - name: secrets-manager-cross-account
+            resource: aws.secrets-manager
+            filters:
+              - type: cross-account
+            actions:
+              - type: remove-statements
+                statement_ids: matched
+    """
+
+    permissions = ("secretsmanager:DeleteResourcePolicy", "secretsmanager:PutResourcePolicy",)
+
+    def validate(self):
+        for f in self.manager.iter_filters():
+            if isinstance(f, CrossAccountAccessFilter):
+                return self
+        raise PolicyValidationError(
+            '`remove-statements` may only be used in '
+            'conjunction with `cross-account` filter on %s' % (self.manager.data,))
+
+    def process(self, resources):
+        client = local_session(self.manager.session_factory).client('secretsmanager')
+        for r in resources:
+            try:
+                self.process_resource(client, r)
+            except Exception:
+                self.log.exception("Error processing secretsmanager:%s", r['ARN'])
+
+    def process_resource(self, client, resource):
+        p = json.loads(resource.get('c7n:AccessPolicy'))
+        if p is None:
+            return
+
+        statements, found = self.process_policy(
+            p, resource, CrossAccountAccessFilter.annotation_key)
+
+        if not found:
+            return
+        if statements:
+            client.put_resource_policy(
+                SecretId=resource['ARN'],
+                ResourcePolicy=json.dumps(p)
+            )
+        else:
+            client.delete_resource_policy(SecretId=resource['ARN'])


Test patch:
diff --git a/tests/data/placebo/test_secrets_manager_delete/secretsmanager.DeleteSecret_1.json b/tests/data/placebo/test_secrets_manager_delete/secretsmanager.DeleteSecret_1.json
new file mode 100644
index 000000000..61dacc1ee
--- /dev/null
+++ b/tests/data/placebo/test_secrets_manager_delete/secretsmanager.DeleteSecret_1.json
@@ -0,0 +1,18 @@
+{
+    "status_code": 200,
+    "data": {
+        "ARN": "arn:aws:secretsmanager:us-east-1:644160558196:secret:test-ZO5wu6",
+        "Name": "test",
+        "DeletionDate": {
+            "__class__": "datetime",
+            "year": 2023,
+            "month": 1,
+            "day": 24,
+            "hour": 15,
+            "minute": 11,
+            "second": 57,
+            "microsecond": 430000
+        },
+        "ResponseMetadata": {}
+    }
+}
\ No newline at end of file
diff --git a/tests/data/placebo/test_secrets_manager_delete/secretsmanager.DescribeSecret_1.json b/tests/data/placebo/test_secrets_manager_delete/secretsmanager.DescribeSecret_1.json
new file mode 100644
index 000000000..f4ceef1cd
--- /dev/null
+++ b/tests/data/placebo/test_secrets_manager_delete/secretsmanager.DescribeSecret_1.json
@@ -0,0 +1,35 @@
+{
+    "status_code": 200,
+    "data": {
+        "ARN": "arn:aws:secretsmanager:us-east-1:644160558196:secret:test1-KGqqf5",
+        "Name": "test1",
+        "KmsKeyId": "arn:aws:kms:us-east-1:644160558196:key/36812ccf-daaf-49b1-a24b-0eef254ffe41",
+        "LastChangedDate": {
+            "__class__": "datetime",
+            "year": 2023,
+            "month": 1,
+            "day": 17,
+            "hour": 15,
+            "minute": 11,
+            "second": 3,
+            "microsecond": 974000
+        },
+        "Tags": [],
+        "VersionIdsToStages": {
+            "104bddd6-77c3-4d3f-a02f-86f2fba45266": [
+                "AWSCURRENT"
+            ]
+        },
+        "CreatedDate": {
+            "__class__": "datetime",
+            "year": 2022,
+            "month": 8,
+            "day": 23,
+            "hour": 15,
+            "minute": 32,
+            "second": 20,
+            "microsecond": 440000
+        },
+        "ResponseMetadata": {}
+    }
+}
\ No newline at end of file
diff --git a/tests/data/placebo/test_secrets_manager_delete/secretsmanager.DescribeSecret_2.json b/tests/data/placebo/test_secrets_manager_delete/secretsmanager.DescribeSecret_2.json
new file mode 100644
index 000000000..2ce2211d9
--- /dev/null
+++ b/tests/data/placebo/test_secrets_manager_delete/secretsmanager.DescribeSecret_2.json
@@ -0,0 +1,49 @@
+{
+    "status_code": 200,
+    "data": {
+        "ARN": "arn:aws:secretsmanager:us-east-1:644160558196:secret:test-ZO5wu6",
+        "Name": "test",
+        "LastChangedDate": {
+            "__class__": "datetime",
+            "year": 2023,
+            "month": 1,
+            "day": 17,
+            "hour": 15,
+            "minute": 11,
+            "second": 25,
+            "microsecond": 834000
+        },
+        "Tags": [],
+        "VersionIdsToStages": {
+            "6ad5e6c9-2fbd-43bb-9f9b-2f9ccd67f283": [
+                "AWSCURRENT"
+            ]
+        },
+        "CreatedDate": {
+            "__class__": "datetime",
+            "year": 2022,
+            "month": 10,
+            "day": 19,
+            "hour": 10,
+            "minute": 28,
+            "second": 27,
+            "microsecond": 837000
+        },
+        "PrimaryRegion": "us-east-1",
+        "ReplicationStatus": [
+            {
+                "Region": "us-east-2",
+                "KmsKeyId": "alias/aws/secretsmanager",
+                "Status": "InSync",
+                "StatusMessage": "Replication succeeded"
+            },
+            {
+                "Region": "us-west-2",
+                "KmsKeyId": "alias/aws/secretsmanager",
+                "Status": "InSync",
+                "StatusMessage": "Replication succeeded"
+            }
+        ],
+        "ResponseMetadata": {}
+    }
+}
\ No newline at end of file
diff --git a/tests/data/placebo/test_secrets_manager_delete/secretsmanager.DescribeSecret_3.json b/tests/data/placebo/test_secrets_manager_delete/secretsmanager.DescribeSecret_3.json
new file mode 100644
index 000000000..b0b09e850
--- /dev/null
+++ b/tests/data/placebo/test_secrets_manager_delete/secretsmanager.DescribeSecret_3.json
@@ -0,0 +1,44 @@
+{
+    "status_code": 200,
+    "data": {
+        "ARN": "arn:aws:secretsmanager:us-east-1:644160558196:secret:test-ZO5wu6",
+        "Name": "test",
+        "LastChangedDate": {
+            "__class__": "datetime",
+            "year": 2023,
+            "month": 1,
+            "day": 17,
+            "hour": 15,
+            "minute": 11,
+            "second": 57,
+            "microsecond": 450000
+        },
+        "DeletedDate": {
+            "__class__": "datetime",
+            "year": 2023,
+            "month": 1,
+            "day": 17,
+            "hour": 15,
+            "minute": 11,
+            "second": 57,
+            "microsecond": 441000
+        },
+        "Tags": [],
+        "VersionIdsToStages": {
+            "6ad5e6c9-2fbd-43bb-9f9b-2f9ccd67f283": [
+                "AWSCURRENT"
+            ]
+        },
+        "CreatedDate": {
+            "__class__": "datetime",
+            "year": 2022,
+            "month": 10,
+            "day": 19,
+            "hour": 10,
+            "minute": 28,
+            "second": 27,
+            "microsecond": 837000
+        },
+        "ResponseMetadata": {}
+    }
+}
\ No newline at end of file
diff --git a/tests/data/placebo/test_secrets_manager_delete/secretsmanager.ListSecrets_1.json b/tests/data/placebo/test_secrets_manager_delete/secretsmanager.ListSecrets_1.json
new file mode 100644
index 000000000..82af733b2
--- /dev/null
+++ b/tests/data/placebo/test_secrets_manager_delete/secretsmanager.ListSecrets_1.json
@@ -0,0 +1,70 @@
+{
+    "status_code": 200,
+    "data": {
+        "SecretList": [
+            {
+                "ARN": "arn:aws:secretsmanager:us-east-1:644160558196:secret:test1-KGqqf5",
+                "Name": "test1",
+                "KmsKeyId": "arn:aws:kms:us-east-1:644160558196:key/36812ccf-daaf-49b1-a24b-0eef254ffe41",
+                "LastChangedDate": {
+                    "__class__": "datetime",
+                    "year": 2023,
+                    "month": 1,
+                    "day": 17,
+                    "hour": 15,
+                    "minute": 11,
+                    "second": 3,
+                    "microsecond": 974000
+                },
+                "Tags": [],
+                "SecretVersionsToStages": {
+                    "104bddd6-77c3-4d3f-a02f-86f2fba45266": [
+                        "AWSCURRENT"
+                    ]
+                },
+                "CreatedDate": {
+                    "__class__": "datetime",
+                    "year": 2022,
+                    "month": 8,
+                    "day": 23,
+                    "hour": 15,
+                    "minute": 32,
+                    "second": 20,
+                    "microsecond": 440000
+                }
+            },
+            {
+                "ARN": "arn:aws:secretsmanager:us-east-1:644160558196:secret:test-ZO5wu6",
+                "Name": "test",
+                "LastChangedDate": {
+                    "__class__": "datetime",
+                    "year": 2023,
+                    "month": 1,
+                    "day": 17,
+                    "hour": 15,
+                    "minute": 11,
+                    "second": 25,
+                    "microsecond": 834000
+                },
+                "Tags": [],
+                "SecretVersionsToStages": {
+                    "6ad5e6c9-2fbd-43bb-9f9b-2f9ccd67f283": [
+                        "AWSCURRENT"
+                    ]
+                },
+                "CreatedDate": {
+                    "__class__": "datetime",
+                    "year": 2022,
+                    "month": 10,
+                    "day": 19,
+                    "hour": 10,
+                    "minute": 28,
+                    "second": 27,
+                    "microsecond": 837000
+                },
+                "PrimaryRegion": "us-east-1"
+            }
+        ],
+        "ResponseMetadata": {}
+    }
+}
\ No newline at end of file
diff --git a/tests/data/placebo/test_secrets_manager_delete/secretsmanager.RemoveRegionsFromReplication_1.json b/tests/data/placebo/test_secrets_manager_delete/secretsmanager.RemoveRegionsFromReplication_1.json
new file mode 100644
index 000000000..e551c15b4
--- /dev/null
+++ b/tests/data/placebo/test_secrets_manager_delete/secretsmanager.RemoveRegionsFromReplication_1.json
@@ -0,0 +1,8 @@
+{
+    "status_code": 200,
+    "data": {
+        "ARN": "arn:aws:secretsmanager:us-east-1:644160558196:secret:test-ZO5wu6",
+        "ReplicationStatus": [],
+        "ResponseMetadata": {}
+    }
+}
\ No newline at end of file
diff --git a/tests/data/placebo/test_secretsmanager_remove_matched/secretsmanager.DescribeSecret_1.json b/tests/data/placebo/test_secretsmanager_remove_matched/secretsmanager.DescribeSecret_1.json
new file mode 100644
index 000000000..c93f3b0b0
--- /dev/null
+++ b/tests/data/placebo/test_secretsmanager_remove_matched/secretsmanager.DescribeSecret_1.json
@@ -0,0 +1,34 @@
+{
+    "status_code": 200,
+    "data": {
+        "ARN": "arn:aws:secretsmanager:us-east-1:644160558196:secret:test-ZO5wu6",
+        "Name": "test",
+        "LastChangedDate": {
+            "__class__": "datetime",
+            "year": 2023,
+            "month": 1,
+            "day": 13,
+            "hour": 12,
+            "minute": 29,
+            "second": 2,
+            "microsecond": 873000
+        },
+        "Tags": [],
+        "VersionIdsToStages": {
+            "6ad5e6c9-2fbd-43bb-9f9b-2f9ccd67f283": [
+                "AWSCURRENT"
+            ]
+        },
+        "CreatedDate": {
+            "__class__": "datetime",
+            "year": 2022,
+            "month": 10,
+            "day": 19,
+            "hour": 10,
+            "minute": 28,
+            "second": 27,
+            "microsecond": 837000
+        },
+        "ResponseMetadata": {}
+    }
+}
\ No newline at end of file
diff --git a/tests/data/placebo/test_secretsmanager_remove_matched/secretsmanager.GetResourcePolicy_1.json b/tests/data/placebo/test_secretsmanager_remove_matched/secretsmanager.GetResourcePolicy_1.json
new file mode 100644
index 000000000..133b9e17f
--- /dev/null
+++ b/tests/data/placebo/test_secretsmanager_remove_matched/secretsmanager.GetResourcePolicy_1.json
@@ -0,0 +1,9 @@
+{
+    "status_code": 200,
+    "data": {
+        "ARN": "arn:aws:secretsmanager:us-east-1:644160558196:secret:test-ZO5wu6",
+        "Name": "test",
+        "ResourcePolicy": "{\n  \"Version\" : \"2012-10-17\",\n  \"Statement\" : [ {\n    \"Sid\" : \"SpecificAllow\",\n    \"Effect\" : \"Allow\",\n    \"Principal\" : {\n      \"AWS\" : \"arn:aws:iam::644160558196:user/Peter\"\n    },\n    \"Action\" : \"secretsmanager:GetSecretValue\",\n    \"Resource\" : \"*\"\n  }, {\n    \"Sid\" : \"CrossAccount\",\n    \"Effect\" : \"Allow\",\n    \"Principal\" : {\n      \"AWS\" : \"arn:aws:iam::040813553448:user/pratyush\"\n    },\n    \"Action\" : \"secretsmanager:GetSecretValue\",\n    \"Resource\" : \"*\"\n  } ]\n}",
+        "ResponseMetadata": {}
+    }
+}
\ No newline at end of file
diff --git a/tests/data/placebo/test_secretsmanager_remove_matched/secretsmanager.GetResourcePolicy_2.json b/tests/data/placebo/test_secretsmanager_remove_matched/secretsmanager.GetResourcePolicy_2.json
new file mode 100644
index 000000000..8ec989b48
--- /dev/null
+++ b/tests/data/placebo/test_secretsmanager_remove_matched/secretsmanager.GetResourcePolicy_2.json
@@ -0,0 +1,9 @@
+{
+    "status_code": 200,
+    "data": {
+        "ARN": "arn:aws:secretsmanager:us-east-1:644160558196:secret:test-ZO5wu6",
+        "Name": "test",
+        "ResourcePolicy": "{\n  \"Version\" : \"2012-10-17\",\n  \"Statement\" : [ {\n    \"Sid\" : \"SpecificAllow\",\n    \"Effect\" : \"Allow\",\n    \"Principal\" : {\n      \"AWS\" : \"arn:aws:iam::644160558196:user/Peter\"\n    },\n    \"Action\" : \"secretsmanager:GetSecretValue\",\n    \"Resource\" : \"*\"\n  } ]\n}",
+        "ResponseMetadata": {}
+    }
+}
\ No newline at end of file
diff --git a/tests/data/placebo/test_secretsmanager_remove_matched/secretsmanager.ListSecrets_1.json b/tests/data/placebo/test_secretsmanager_remove_matched/secretsmanager.ListSecrets_1.json
new file mode 100644
index 000000000..c8f577b0e
--- /dev/null
+++ b/tests/data/placebo/test_secretsmanager_remove_matched/secretsmanager.ListSecrets_1.json
@@ -0,0 +1,38 @@
+{
+    "status_code": 200,
+    "data": {
+        "SecretList": [
+            {
+                "ARN": "arn:aws:secretsmanager:us-east-1:644160558196:secret:test-ZO5wu6",
+                "Name": "test",
+                "LastChangedDate": {
+                    "__class__": "datetime",
+                    "year": 2023,
+                    "month": 1,
+                    "day": 13,
+                    "hour": 12,
+                    "minute": 28,
+                    "second": 22,
+                    "microsecond": 118000
+                },
+                "Tags": [],
+                "SecretVersionsToStages": {
+                    "6ad5e6c9-2fbd-43bb-9f9b-2f9ccd67f283": [
+                        "AWSCURRENT"
+                    ]
+                },
+                "CreatedDate": {
+                    "__class__": "datetime",
+                    "year": 2022,
+                    "month": 10,
+                    "day": 19,
+                    "hour": 10,
+                    "minute": 28,
+                    "second": 27,
+                    "microsecond": 837000
+                }
+            }
+        ],
+        "ResponseMetadata": {}
+    }
+}
\ No newline at end of file
diff --git a/tests/data/placebo/test_secretsmanager_remove_matched/secretsmanager.PutResourcePolicy_1.json b/tests/data/placebo/test_secretsmanager_remove_matched/secretsmanager.PutResourcePolicy_1.json
new file mode 100644
index 000000000..784162bc1
--- /dev/null
+++ b/tests/data/placebo/test_secretsmanager_remove_matched/secretsmanager.PutResourcePolicy_1.json
@@ -0,0 +1,8 @@
+{
+    "status_code": 200,
+    "data": {
+        "ARN": "arn:aws:secretsmanager:us-east-1:644160558196:secret:test-ZO5wu6",
+        "Name": "test",
+        "ResponseMetadata": {}
+    }
+}
\ No newline at end of file
diff --git a/tests/data/placebo/test_secretsmanager_remove_matched/secretsmanager.PutResourcePolicy_2.json b/tests/data/placebo/test_secretsmanager_remove_matched/secretsmanager.PutResourcePolicy_2.json
new file mode 100644
index 000000000..784162bc1
--- /dev/null
+++ b/tests/data/placebo/test_secretsmanager_remove_matched/secretsmanager.PutResourcePolicy_2.json
@@ -0,0 +1,8 @@
+{
+    "status_code": 200,
+    "data": {
+        "ARN": "arn:aws:secretsmanager:us-east-1:644160558196:secret:test-ZO5wu6",
+        "Name": "test",
+        "ResponseMetadata": {}
+    }
+}
\ No newline at end of file
diff --git a/tests/data/placebo/test_secretsmanager_remove_rbp/secretsmanager.DeleteResourcePolicy_1.json b/tests/data/placebo/test_secretsmanager_remove_rbp/secretsmanager.DeleteResourcePolicy_1.json
new file mode 100644
index 000000000..784162bc1
--- /dev/null
+++ b/tests/data/placebo/test_secretsmanager_remove_rbp/secretsmanager.DeleteResourcePolicy_1.json
@@ -0,0 +1,8 @@
+{
+    "status_code": 200,
+    "data": {
+        "ARN": "arn:aws:secretsmanager:us-east-1:644160558196:secret:test-ZO5wu6",
+        "Name": "test",
+        "ResponseMetadata": {}
+    }
+}
\ No newline at end of file
diff --git a/tests/data/placebo/test_secretsmanager_remove_rbp/secretsmanager.DescribeSecret_1.json b/tests/data/placebo/test_secretsmanager_remove_rbp/secretsmanager.DescribeSecret_1.json
new file mode 100644
index 000000000..a7114deee
--- /dev/null
+++ b/tests/data/placebo/test_secretsmanager_remove_rbp/secretsmanager.DescribeSecret_1.json
@@ -0,0 +1,34 @@
+{
+    "status_code": 200,
+    "data": {
+        "ARN": "arn:aws:secretsmanager:us-east-1:644160558196:secret:test-ZO5wu6",
+        "Name": "test",
+        "LastChangedDate": {
+            "__class__": "datetime",
+            "year": 2023,
+            "month": 1,
+            "day": 13,
+            "hour": 12,
+            "minute": 58,
+            "second": 12,
+            "microsecond": 952000
+        },
+        "Tags": [],
+        "VersionIdsToStages": {
+            "6ad5e6c9-2fbd-43bb-9f9b-2f9ccd67f283": [
+                "AWSCURRENT"
+            ]
+        },
+        "CreatedDate": {
+            "__class__": "datetime",
+            "year": 2022,
+            "month": 10,
+            "day": 19,
+            "hour": 10,
+            "minute": 28,
+            "second": 27,
+            "microsecond": 837000
+        },
+        "ResponseMetadata": {}
+    }
+}
\ No newline at end of file
diff --git a/tests/data/placebo/test_secretsmanager_remove_rbp/secretsmanager.GetResourcePolicy_1.json b/tests/data/placebo/test_secretsmanager_remove_rbp/secretsmanager.GetResourcePolicy_1.json
new file mode 100644
index 000000000..fc29a4969
--- /dev/null
+++ b/tests/data/placebo/test_secretsmanager_remove_rbp/secretsmanager.GetResourcePolicy_1.json
@@ -0,0 +1,9 @@
+{
+    "status_code": 200,
+    "data": {
+        "ARN": "arn:aws:secretsmanager:us-east-1:644160558196:secret:test-ZO5wu6",
+        "Name": "test",
+        "ResourcePolicy": "{\n  \"Version\" : \"2012-10-17\",\n  \"Statement\" : [ {\n    \"Sid\" : \"CrossAccount\",\n    \"Effect\" : \"Allow\",\n    \"Principal\" : {\n      \"AWS\" : \"arn:aws:iam::040813553448:user/pratyush\"\n    },\n    \"Action\" : \"secretsmanager:GetSecretValue\",\n    \"Resource\" : \"*\"\n  } ]\n}",
+        "ResponseMetadata": {}
+    }
+}
\ No newline at end of file
diff --git a/tests/data/placebo/test_secretsmanager_remove_rbp/secretsmanager.GetResourcePolicy_2.json b/tests/data/placebo/test_secretsmanager_remove_rbp/secretsmanager.GetResourcePolicy_2.json
new file mode 100644
index 000000000..784162bc1
--- /dev/null
+++ b/tests/data/placebo/test_secretsmanager_remove_rbp/secretsmanager.GetResourcePolicy_2.json
@@ -0,0 +1,8 @@
+{
+    "status_code": 200,
+    "data": {
+        "ARN": "arn:aws:secretsmanager:us-east-1:644160558196:secret:test-ZO5wu6",
+        "Name": "test",
+        "ResponseMetadata": {}
+    }
+}
\ No newline at end of file
diff --git a/tests/data/placebo/test_secretsmanager_remove_rbp/secretsmanager.ListSecrets_1.json b/tests/data/placebo/test_secretsmanager_remove_rbp/secretsmanager.ListSecrets_1.json
new file mode 100644
index 000000000..cf48e094d
--- /dev/null
+++ b/tests/data/placebo/test_secretsmanager_remove_rbp/secretsmanager.ListSecrets_1.json
@@ -0,0 +1,38 @@
+{
+    "status_code": 200,
+    "data": {
+        "SecretList": [
+            {
+                "ARN": "arn:aws:secretsmanager:us-east-1:644160558196:secret:test-ZO5wu6",
+                "Name": "test",
+                "LastChangedDate": {
+                    "__class__": "datetime",
+                    "year": 2023,
+                    "month": 1,
+                    "day": 13,
+                    "hour": 12,
+                    "minute": 57,
+                    "second": 54,
+                    "microsecond": 168000
+                },
+                "Tags": [],
+                "SecretVersionsToStages": {
+                    "6ad5e6c9-2fbd-43bb-9f9b-2f9ccd67f283": [
+                        "AWSCURRENT"
+                    ]
+                },
+                "CreatedDate": {
+                    "__class__": "datetime",
+                    "year": 2022,
+                    "month": 10,
+                    "day": 19,
+                    "hour": 10,
+                    "minute": 28,
+                    "second": 27,
+                    "microsecond": 837000
+                }
+            }
+        ],
+        "ResponseMetadata": {}
+    }
+}
\ No newline at end of file
diff --git a/tests/data/placebo/test_secretsmanager_remove_rbp/secretsmanager.PutResourcePolicy_1.json b/tests/data/placebo/test_secretsmanager_remove_rbp/secretsmanager.PutResourcePolicy_1.json
new file mode 100644
index 000000000..784162bc1
--- /dev/null
+++ b/tests/data/placebo/test_secretsmanager_remove_rbp/secretsmanager.PutResourcePolicy_1.json
@@ -0,0 +1,8 @@
+{
+    "status_code": 200,
+    "data": {
+        "ARN": "arn:aws:secretsmanager:us-east-1:644160558196:secret:test-ZO5wu6",
+        "Name": "test",
+        "ResponseMetadata": {}
+    }
+}
\ No newline at end of file
diff --git a/tests/test_secretsmanager.py b/tests/test_secretsmanager.py
index 47b979de2..506c9fbad 100644
--- a/tests/test_secretsmanager.py
+++ b/tests/test_secretsmanager.py
@@ -1,6 +1,8 @@
 # Copyright The Cloud Custodian Authors.
 # SPDX-License-Identifier: Apache-2.0
 from .common import BaseTest
+import json
+from c7n.exceptions import PolicyValidationError
 
 
 class TestSecretsManager(BaseTest):
@@ -108,3 +110,121 @@ class TestSecretsManager(BaseTest):
         self.assertFalse(resources[0].get('Tags'))
         new_tags = client.describe_secret(SecretId="c7n-test-key").get("Tags")
         self.assertTrue("tag@" in new_tags[0].get("Value"))
+
+    def test_secrets_manager_delete(self):
+        session_factory = self.replay_flight_data('test_secrets_manager_delete')
+        client = session_factory(region="us-east-1").client("secretsmanager")
+        p = self.load_policy(
+            {
+                'name': 'secrets-manager-unencrypted-delete',
+                'resource': 'secrets-manager',
+                'filters': [
+                    {
+                        'type': 'value',
+                        'key': 'Name',
+                        'value': 'test'
+                    }
+                ],
+                'actions': [
+                    {
+                        'type': 'delete',
+                        'recovery_window': 7
+                    }
+                ]
+            },
+            session_factory=session_factory
+        )
+        resources = p.run()
+        self.assertEqual(len(resources), 1)
+        self.assertEqual(resources[0]['Name'], 'test')
+        self.assertEqual(len(resources[0].get('ReplicationStatus')), 2)
+        secret_for_del = client.describe_secret(SecretId=resources[0]['ARN'])
+        self.assertTrue('DeletedDate' in secret_for_del)
+
+    def test_secretsmanager_remove_matched(self):
+        session_factory = self.replay_flight_data("test_secretsmanager_remove_matched")
+        resource_id = 'arn:aws:secretsmanager:us-east-1:644160558196:secret:test-ZO5wu6'
+        client = session_factory().client("secretsmanager")
+        client.put_resource_policy(SecretId=resource_id, ResourcePolicy=json.dumps(
+            {
+                "Version": "2012-10-17",
+                "Statement": [
+                    {
+                        "Sid": "SpecificAllow",
+                        "Effect": "Allow",
+                        "Principal": {
+                            "AWS": "arn:aws:iam::644160558196:user/Peter"
+                        },
+                        "Action": "secretsmanager:GetSecretValue",
+                        "Resource": "*"
+                    },
+                    {
+                        "Sid": "CrossAccount",
+                        "Effect": "Allow",
+                        "Principal": {
+                            "AWS": "arn:aws:iam::040813553448:user/pratyush"
+                        },
+                        "Action": "secretsmanager:GetSecretValue",
+                        "Resource": "*"
+                    }
+                ]
+            }))
+        p = self.load_policy(
+            {
+                "name": "secrets-manager-rm-matched",
+                "resource": "secrets-manager",
+                "filters": [{"type": "cross-account"}],
+                "actions": [{"type": "remove-statements", "statement_ids": "matched"}],
+            },
+            session_factory=session_factory,
+        )
+        resources = p.run()
+        self.assertEqual(len(resources), 1)
+        data = client.get_resource_policy(SecretId=resource_id)
+        access_policy = json.loads(data.get('ResourcePolicy'))
+        self.assertEqual(len(access_policy.get('Statement')), 1)
+        self.assertEqual([s['Sid'] for s in access_policy.get('Statement')], ["SpecificAllow"])
+
+    def test_secretsmanager_remove_rbp(self):
+        session_factory = self.replay_flight_data("test_secretsmanager_remove_rbp")
+        resource_id = 'arn:aws:secretsmanager:us-east-1:644160558196:secret:test-ZO5wu6'
+        client = session_factory().client("secretsmanager")
+        client.put_resource_policy(SecretId=resource_id, ResourcePolicy=json.dumps(
+            {
+                "Version": "2012-10-17",
+                "Statement": [
+                    {
+                        "Sid": "CrossAccount",
+                        "Effect": "Allow",
+                        "Principal": {
+                            "AWS": "arn:aws:iam::040813553448:user/pratyush"
+                        },
+                        "Action": "secretsmanager:GetSecretValue",
+                        "Resource": "*"
+                    }
+                ]
+            }))
+        p = self.load_policy(
+            {
+                "name": "secrets-manager-rm-rbp",
+                "resource": "secrets-manager",
+                "filters": [{"type": "cross-account"}],
+                "actions": [{"type": "remove-statements", "statement_ids": "matched"}],
+            },
+            session_factory=session_factory,
+        )
+        resources = p.run()
+        self.assertEqual(len(resources), 1)
+        data = client.get_resource_policy(SecretId=resource_id)
+        self.assertEqual(data.get('ResourcePolicy'), None)
+
+    def test_remove_statements_validation_error(self):
+        self.assertRaises(
+            PolicyValidationError,
+            self.load_policy,
+            {
+                "name": "secrets-manager-remove-matched",
+                "resource": "secrets-manager",
+                "actions": [{"type": "remove-statements", "statement_ids": "matched"}],
+            }
+        )