Fix AWS::SecretsManager::Secret ARN/Physical ID handling and tests
diff --git a/localstack/services/cloudformation/cloudformation_starter.py b/localstack/services/cloudformation/cloudformation_starter.py
index c2976a97bbf9d..1e71fb11938b3 100644
--- a/localstack/services/cloudformation/cloudformation_starter.py
+++ b/localstack/services/cloudformation/cloudformation_starter.py
@@ -15,7 +15,7 @@
 from localstack.services.cloudformation import service_models
 from localstack.utils.aws import aws_stack
 
-from .models import elasticsearch, events, kinesisfirehose, logs, secretsmanager
+from .models import elasticsearch, events, kinesisfirehose, logs
 
 LOG = logging.getLogger(__name__)
 
@@ -76,20 +76,12 @@ def update_physical_resource_id(resource):
     elif isinstance(resource, kinesisfirehose.FirehoseDeliveryStream):
         resource.physical_resource_id = resource.params.get("DeliveryStreamName")
 
-    elif isinstance(resource, secretsmanager.SecretsManagerSecret):
-        resource.physical_resource_id = resource.params.get("Name")
-
     elif isinstance(resource, events.EventsRule):
         resource.physical_resource_id = resource.params.get("Name")
 
     elif isinstance(resource, elasticsearch.ElasticsearchDomain):
         resource.physical_resource_id = resource.params.get("DomainName")
 
-    elif isinstance(resource, secretsmanager.SecretsManagerSecret):
-        secret = secretsmanager.SecretsManagerSecret.fetch_details(resource.props["Name"])
-        if secret:
-            resource.props["ARN"] = resource.physical_resource_id = secret["ARN"]
-
     elif isinstance(resource, dynamodb_models.Table):
         resource.physical_resource_id = resource.name
 
diff --git a/localstack/services/cloudformation/models/secretsmanager.py b/localstack/services/cloudformation/models/secretsmanager.py
index c34ff2705c9c9..3cac2a5d41f5e 100644
--- a/localstack/services/cloudformation/models/secretsmanager.py
+++ b/localstack/services/cloudformation/models/secretsmanager.py
@@ -21,9 +21,7 @@ def cloudformation_type():
         return "AWS::SecretsManager::Secret"
 
     def get_physical_resource_id(self, attribute, **kwargs):
-        props = self.props
-        result = props.get("ARN") or aws_stack.secretsmanager_secret_arn(props["Name"])
-        return result
+        return self.props.get("ARN")
 
     def get_cfn_attribute(self, attribute_name):
         if attribute_name in (REF_ARN_ATTRS + REF_ID_ATTRS):
@@ -77,8 +75,8 @@ def generate_secret_value(
 
     @staticmethod
     def add_defaults(resource, stack_name: str):
-        role_name = resource.get("Properties", {}).get("Name")
-        if not role_name:
+        name = resource.get("Properties", {}).get("Name")
+        if not name:
             resource["Properties"]["Name"] = generate_default_name(
                 stack_name, resource["LogicalResourceId"]
             )
diff --git a/localstack/utils/aws/aws_stack.py b/localstack/utils/aws/aws_stack.py
index ba52f5a7c523b..cae8a87ae7d7d 100644
--- a/localstack/utils/aws/aws_stack.py
+++ b/localstack/utils/aws/aws_stack.py
@@ -535,6 +535,7 @@ def get_iam_role(resource, env=None):
     return "role-%s" % resource
 
 
+# TODO: remove this (can't statically define secret ARN because it includes a random suffix)
 def secretsmanager_secret_arn(secret_id, account_id=None, region_name=None):
     if ":" in (secret_id or ""):
         return secret_id
diff --git a/localstack/utils/cloudformation/template_deployer.py b/localstack/utils/cloudformation/template_deployer.py
index ab7b813fdbbbf..02b29f4ddb9a7 100644
--- a/localstack/utils/cloudformation/template_deployer.py
+++ b/localstack/utils/cloudformation/template_deployer.py
@@ -84,15 +84,6 @@ def lambda_get_params():
 # ----------------
 
 
-def get_secret_arn(secret_name, account_id=None):
-    # TODO: create logic to create static without lookup table!
-    from localstack.services.secretsmanager import secretsmanager_starter
-
-    storage = secretsmanager_starter.SECRET_ARN_STORAGE
-    key = "%s_%s" % (aws_stack.get_region(), secret_name)
-    return storage.get(key) or storage.get(secret_name)
-
-
 def find_stack(stack_name):
     from localstack.services.cloudformation.cloudformation_api import find_stack as api_find_stack
 
@@ -1024,11 +1015,6 @@ def determine_resource_physical_id(
         if attribute == "Arn":
             return aws_stack.role_arn(resource_props.get("RoleName"))
         return resource_props.get("RoleName")
-    elif resource_type == "SecretsManager::Secret":
-        arn = get_secret_arn(resource_props.get("Name")) or ""
-        if attribute == "Arn":
-            return arn
-        return arn.split(":")[-1]
     elif resource_type == "IAM::Policy":
         if attribute == "Arn":
             return aws_stack.policy_arn(resource_props.get("PolicyName"))
diff --git a/tests/integration/cloudformation/test_cloudformation_secretsmanager.py b/tests/integration/cloudformation/test_cloudformation_secretsmanager.py
index ddff456cad024..18a6c9c49b489 100644
--- a/tests/integration/cloudformation/test_cloudformation_secretsmanager.py
+++ b/tests/integration/cloudformation/test_cloudformation_secretsmanager.py
@@ -15,7 +15,7 @@
       Description: Aurora Password
       Name: %s
       GenerateSecretString:
-        SecretStringTemplate: !Sub '{"username": "${Username}"}'
+        SecretStringTemplate: '{"username": "localstack-user"}'
         GenerateStringKey: "password"
         PasswordLength: 30
         IncludeSpace: false
@@ -47,17 +47,21 @@ def test_cfn_secretsmanager_gen_secret(
         assert "/dev/db/pass" == secret["Name"]
         assert "secret:/dev/db/pass" in secret["ARN"]
 
-        # assert that secret has ben generated and added to the result template JSON
-        value = secretsmanager_client.get_secret_value(SecretId="/dev/db/pass")
-        secret = value.get("SecretString")
-        secret = json.loads(secret)
-        assert "password" in secret
-        assert len(secret["password"]) == 30
+        # assert that secret has been generated and added to the result template JSON
+        secret_value = secretsmanager_client.get_secret_value(SecretId="/dev/db/pass")[
+            "SecretString"
+        ]
+        secret_json = json.loads(secret_value)
+        assert "password" in secret_json
+        assert len(secret_json["password"]) == 30
 
         # assert that the Ref properly returns the secret ARN
         result = cfn_client.describe_stacks(StackName=stack_name)["Stacks"][0]
         assert len(result["Outputs"]) == 1
+
         assert result["Outputs"][0]["OutputKey"] == "SecretARN"
-        assert re.match(r".*%s-[a-zA-Z0-9]+" % SECRET_NAME, result["Outputs"][0]["OutputValue"])
+        output_secret_arn = result["Outputs"][0]["OutputValue"]
+        assert output_secret_arn == secret["ARN"]
+        assert re.match(r".*%s-[a-zA-Z0-9]+" % SECRET_NAME, output_secret_arn)
     finally:
         cleanup_stacks([stack_id])

There were some issues with the AWS::SecretsManager::Secret  and the related cloudformation test. 

Removes the Username reference from the test template since this isn't actually defined and correctly fails when trying to deploy on AWS. The test now works both against AWS and LocalStack.

Also removes some presumably legacy code and unnecessary physical-id-generating fallbacks that led to some issues/race conditions when deploying the secret where the output resolved to the wrong ARN in up to 50% of test runs.