AWS Secrets Manager - deny access to secret to all but 1 role - aws-secrets-manager

Question

I have a secret, that I only want 2 roles to read.
A DBA role must be able to access the secret and set the value
A terraform role must be able to READ the secret value.
I have set secret policies to reflect this, BUT other roles are still able to read my secret value.
e.g. my admins role
How would I explicitly deny all other roles ?
resource "aws_secretsmanager_secret" "mysecret" {
name = "tch/abc/mysecret"
policy = data.aws_iam_policy_document.mysecret_secret_assume.json
}
data aws_iam_policy_document "mysecret_secret_assume" {
statement [
{
effect = "Allow"
principals {
identifiers = ["${aws_iam_role.setter.arn}"]
type = "AWS"
}
actions = [
"secretsmanager:ListSecrets",
"secretsmanager:GetResourcePolicy",
"secretsmanager:GetSecretValue",
"secretsmanager:DescribeSecret",
"secretsmanager:ListSecretVersionIds",
"secretsmanager:PutSecretValue",
"secretsmanager:UpdateSecretVersionStage",
"secretsmanager:UpdateSecret",
"secretsmanager:GetSecret"
]
resources = ["*"]
},
{
effect = "Allow"
principals {
identifiers = "arn:aws:iam::${local.account}:role/Terraform"
type = "AWS"
}
actions = [
"secretsmanager:GetSecret",
"secretsmanager:GetSecretValue",
"secretsmanager:ListSecrets"
]
resources = ["*"]
}
]
}

Answer 1

I assume your admin role are created by IAM policy, and usually the admin role have all permission. Which means when you don't have secret resource policy claim anything about admin role, it will follow the IAM policy' permission.
You can try to add one statement like:
{
effect = "Deny"
principals {
identifiers = $here put your admin role identifier$,
type = "AWS"
}
actions = [
"secretsmanager:*"
]
resources = ["*"]
},