AWS Secrets Manager Terraform: Least-Privilege Access (blog.victorsilva.com.uy)

I don't even have a long dash on my keyboard.

If you can modify role IAM, I'd start with SSM Parameter Store + KMS encryption for secret values. That is generally much cheaper since typical use fits in the free tier.

They also recently added resource policies to parameters but I don't you have to opt in to the paid tier of offering--not sure how cost compared to Secrets for that.

This is just straight slop. The person who prompted this didn't read it, you shouldn't waste your time on it either.