reviewing-secrets-manager-access-policy-trust

Reviewing secrets-manager access-policy trust: who can actually read the secret

A managed secrets store is only as strong as the policy that decides who reads each secret, and that decision is rarely written in one place. The effective read set is the union of the secret's resource policy, the identity policies of every principal in the account, and the permission to decrypt the key that protects the secret. A secret can look locked down on its resource policy while a broad identity policy elsewhere grants read on every secret, or while a wide key-decrypt grant lets a principal decrypt what the store would otherwise deny. Wildcards on secret names or paths quietly sweep in unrelated secrets. You review these by computing who the combined policy actually admits and comparing that to the secret's intended consumers.

When to use

• Applications fetch secrets from a managed secrets manager or a vault-style store.
• Access is governed by a combination of resource policy, identity policy, and key-decrypt permission.
• Secret names or paths are matched by wildcard in any policy that grants read.

Scope check

Review secret access only in accounts and stores you own or are authorized to assess. Confirming a read retrieves a real secret value, so stay inside the authorized store and treat any retrieved value as sensitive within scope, never exfiltrating it. If you can't name the authorization, stop.

The loop

1. Establish the secret's intended consumers first. For each secret, name the principals that legitimately need to read it: the specific service role, the specific workload. This is the false-positive killer: a policy admitting exactly those consumers is correct however powerful the store is. Name the consumers, then compute the actual read set against them.

2. Read the resource policy for who it admits. The secret's own policy grants read to named principals or patterns. Determine the true set it admits, noting any broad principal (an account, a wildcard) and any condition that is meant to scope it. This is one term of the union, not the whole answer.