diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md
index f750aa1..1267a43 100644
--- a/charts/spire/charts/spire-server/README.md
+++ b/charts/spire/charts/spire-server/README.md
@@ -229,6 +229,12 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
 | `upstreamAuthority.awsPCA.signingAlgorithm`                                                  | (Optional) Signing algorithm to use for the server's CA. Defaults to the CA's default. See Issue Certificate (https://docs.aws.amazon.com/cli/latest/reference/acm-pca/issue-certificate.html) for possible values.                                                                                                                                                                                  | `""`                                                                                           |
 | `upstreamAuthority.awsPCA.endpoint`                                                          | (Optional) Endpoint as hostname or fully-qualified URI that overrides the default endpoint. See AWS SDK Config docs (https://docs.aws.amazon.com/sdk-for-go/api/aws/#Config) for more information.                                                                                                                                                                                                   | `""`                                                                                           |
 | `upstreamAuthority.awsPCA.supplementalBundlePath`                                            | (Optional) Path to a file containing PEM-encoded CA certificates that should be additionally included in the bundle.                                                                                                                                                                                                                                                                                 | `""`                                                                                           |
+| `upstreamAuthority.awsSecret.enabled`                                                        | Flag to enable upstream authority plugin with AWS Secrets Manager                                                                                                                                                                                                                                                                                                                                    | `false`                                                                                        |
+| `upstreamAuthority.awsSecret.region`                                                         | AWS Region to use                                                                                                                                                                                                                                                                                                                                                                                    | `""`                                                                                           |
+| `upstreamAuthority.awsSecret.certFileArn`                                                    | ARN or name of the secret containing the intermediate CA certificate                                                                                                                                                                                                                                                                                                                                 | `""`                                                                                           |
+| `upstreamAuthority.awsSecret.keyFileArn`                                                     | ARN or name of the secret containing the intermediate CA private key                                                                                                                                                                                                                                                                                                                                 | `""`                                                                                           |
+| `upstreamAuthority.awsSecret.bundleFileArn`                                                  | (Optional) ARN or name of the secret containing the root CA bundle                                                                                                                                                                                                                                                                                                                                   | `""`                                                                                           |
+| `upstreamAuthority.awsSecret.assumeRoleArn`                                                  | (Optional) ARN of an IAM role to assume                                                                                                                                                                                                                                                                                                                                                              | `""`                                                                                           |
 | `upstreamAuthority.certManager.enabled`                                                      | Flag to enable upstream authority plugin with cert manager                                                                                                                                                                                                                                                                                                                                           | `false`                                                                                        |
 | `upstreamAuthority.certManager.rbac.create`                                                  | Flag to create RBAC roles                                                                                                                                                                                                                                                                                                                                                                            | `true`                                                                                         |
 | `upstreamAuthority.certManager.issuerName`                                                   | Defaults to the release name, override if CA is provided outside of the chart                                                                                                                                                                                                                                                                                                                        | `""`                                                                                           |
diff --git a/charts/spire/charts/spire-server/templates/configmap.yaml b/charts/spire/charts/spire-server/templates/configmap.yaml
index 701187c..2fa417b 100644
--- a/charts/spire/charts/spire-server/templates/configmap.yaml
+++ b/charts/spire/charts/spire-server/templates/configmap.yaml
@@ -507,6 +507,23 @@ plugins:
         {{- end }}
   {{- end }}
   {{- end }}
+  {{- with .Values.upstreamAuthority.awsSecret }}
+  {{- if eq (.enabled | toString) "true" }}
+  {{- $upstreamAuthorityUsed = add1 $upstreamAuthorityUsed }}
+  UpstreamAuthority:
+    awssecret:
+      plugin_data:
+        region: {{ .region | quote }}
+        cert_file_arn: {{ .certFileArn | quote }}
+        key_file_arn: {{ .keyFileArn | quote }}
+        {{- if ne .bundleFileArn "" }}
+        bundle_file_arn: {{ .bundleFileArn | quote }}
+        {{- end }}
+        {{- if ne .assumeRoleArn "" }}
+        assume_role_arn: {{ .assumeRoleArn | quote }}
+        {{- end }}
+  {{- end }}
+  {{- end }}
 {{- if gt $upstreamAuthorityUsed 1 }}
 {{- fail "You can only enable a single Upstream Authority." }}
 {{- end }}
diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml
index 8387d5e..be57d98 100644
--- a/charts/spire/charts/spire-server/values.yaml
+++ b/charts/spire/charts/spire-server/values.yaml
@@ -448,6 +448,19 @@ upstreamAuthority:
     endpoint: ""
     ## @param upstreamAuthority.awsPCA.supplementalBundlePath (Optional) Path to a file containing PEM-encoded CA certificates that should be additionally included in the bundle.
     supplementalBundlePath: ""
+  awsSecret:
+    ## @param upstreamAuthority.awsSecret.enabled Flag to enable upstream authority plugin with AWS Secrets Manager
+    enabled: false
+    ## @param upstreamAuthority.awsSecret.region AWS Region to use
+    region: ""
+    ## @param upstreamAuthority.awsSecret.certFileArn ARN or name of the secret containing the intermediate CA certificate
+    certFileArn: ""
+    ## @param upstreamAuthority.awsSecret.keyFileArn ARN or name of the secret containing the intermediate CA private key
+    keyFileArn: ""
+    ## @param upstreamAuthority.awsSecret.bundleFileArn (Optional) ARN or name of the secret containing the root CA bundle
+    bundleFileArn: ""
+    ## @param upstreamAuthority.awsSecret.assumeRoleArn (Optional) ARN of an IAM role to assume
+    assumeRoleArn: ""
   certManager:
     ## @param upstreamAuthority.certManager.enabled Flag to enable upstream authority plugin with cert manager
     enabled: false