How do I access AWS Secrets Manager from an EC2 instance with IAM roles?

import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";

// Create an IAM role with a policy to access Secrets Manager
const role = new aws.iam.Role("ec2Role", {
    assumeRolePolicy: aws.iam.assumeRolePolicyForPrincipal({ Service: "ec2.amazonaws.com" }),
});

const policy = new aws.iam.RolePolicy("secretsManagerPolicy", {
    role: role.id,
    policy: pulumi.output({
        Version: "2012-10-17",
        Statement: [{
            Action: [
                "secretsmanager:GetSecretValue",
                "secretsmanager:DescribeSecret",
            ],
            Effect: "Allow",
            Resource: "*", // You could specify a specific secret ARN here
        }],
    }),
});

// Create an instance profile for the IAM role
const instanceProfile = new aws.iam.InstanceProfile("ec2InstanceProfile", {
    role: role.name,
});

// Create a security group for the EC2 instance
const securityGroup = new aws.ec2.SecurityGroup("web-secgrp", {
    description: "Enable HTTP access",
    ingress: [
        { protocol: "tcp", fromPort: 80, toPort: 80, cidrBlocks: ["0.0.0.0/0"] },
    ],
});

// Create an EC2 instance with the IAM role attached
const ami = aws.ec2.getAmi({
    filters: [{
        name: "name",
        values: ["amzn2-ami-hvm-*-x86_64-gp2"],
    }],
    mostRecent: true,
    owners: ["137112412989"], // Amazon
});

const instance = new aws.ec2.Instance("web-server", {
    instanceType: "t2.micro",
    securityGroups: [securityGroup.name],
    ami: ami.then(ami => ami.id),
    iamInstanceProfile: instanceProfile.name,
    userData: `#!/bin/bash
    yum install -y aws-cli
    aws secretsmanager get-secret-value --secret-id <your-secret-id> --region <your-region>`,
});

export const instancePublicIp = instance.publicIp;
export const instancePublicDns = instance.publicDns;