diff --git a/roles/product_install/defaults/main.yml b/roles/product_install/defaults/main.yml
index d768e62..92766b3 100644
--- a/roles/product_install/defaults/main.yml
+++ b/roles/product_install/defaults/main.yml
@@ -3,6 +3,9 @@
 # Empty values to simplify logic (no undefineds)
 atl_latest_version: ''
 atl_cached_version: ''
+# if basic_auth is required for download of atlassian installable artifact, provide the name of an AWS Secrets Manager secret
+#  with values for both password and username
+atl_download_secret_name: ''
 
 atl_product_latest_version_url: "https://marketplace.atlassian.com/rest/2/products/key/{{ atl_product_family }}/versions"
 atl_product_version_cache_dir: "{{ atl_product_home_shared }}"
diff --git a/roles/product_install/tasks/main.yml b/roles/product_install/tasks/main.yml
index ffe3c25..e8f8feb 100644
--- a/roles/product_install/tasks/main.yml
+++ b/roles/product_install/tasks/main.yml
@@ -177,11 +177,27 @@
 - name: download_binary is true so fetch and do all the things
   block:
 
-    # Fetch binary and copy to temp
+    # optionally grab basic_auth creds from secrets_manager secret called 'download_atlassian'
+    - name: set basic_auth facts if the secret exists
+      ansible.builtin.set_fact:
+        download_atlassian_password: "{{ lookup('amazon.aws.aws_secret', atl_download_secret_name + '.password', region=ansible_ec2_placement_region, bypath=false, nested=true, on_denied='skip', on_missing='skip') }}"
+        download_atlassian_username: "{{ lookup('amazon.aws.aws_secret', atl_download_secret_name + '.username', region=ansible_ec2_placement_region, bypath=false, nested=true, on_denied='skip', on_missing='skip') }}"
+      failed_when: false
+      no_log: true
+      when: 
+        - ansible_ec2_placement_region is defined
+        - atl_download_secret_name is defined
+      tags:
+        - runtime_pkg
+
+    # Fetch binary and copy to temp 
+    # optionally use basic_auth creds from secrets_manager
     - name: Fetch binary
       ansible.builtin.get_url:
         url: "{{ atl_product_download_url }}"
         dest: "{{ atl_product_temp_download }}"
+        url_password: "{{ download_atlassian_password | default(omit) }}"
+        url_username: "{{ download_atlassian_username | default(omit) }}"
         mode: 0755
         force: false
       register: atl_product_completed