{
    "Version": "2012-10-17",
    "Statement":
    [
        {
            "Effect": "Allow",
            "Principal":
            {
                "Service": "rds.amazonaws.com"
            },
            "Action": "secretsmanager:GetSecretValue",
            "Resource": "*",
            "Condition":
            {
                "StringEquals":
                {
                    "aws:sourceAccount": "<account-id>"
                },
                "ArnLike":
                {
                    "aws:sourceArn": "arn:aws:rds:<region>:<account-id>:db:*"
                }
            }
        }
    ]
}