Check provider logo

Secrets Manager secret has a restrictive resource-based policy

secretsmanager_has_restrictive_resource_policy

Severityhigh
Servicesecretsmanager
by Prowler
secretstrust-boundaries

Secrets Manager secrets are evaluated for restrictive resource-based policies: explicit Deny for unauthorized principals, Organization boundary via PrincipalOrgID, aws:SourceAccount for service access. Per-principal NotAction restrictions are optional (defense-in-depth). Regionalized service principals are supported.

Risk

Without a restrictive resource policy, any IAM principal in the account—or even cross-account entities—can read, modify, or delete the secret, compromising confidentiality and integrity. Overly broad policies enable lateral movement and privilege escalation through exposed credentials.

Run this check with Prowler CLI

prowler aws --checks secretsmanager_has_restrictive_resource_policy

Run in Prowler Cloud
ARN template
arn:aws:secretsmanager:region:account-id:secret:secret-name

Recommendation

Apply deny-by-default resource policies to every secret:

  • Deny all principals except explicitly authorized roles via StringNotEquals on aws:PrincipalArn
  • Deny access from outside the AWS Organization via aws:PrincipalOrgID
  • Constrain AWS service access with aws:SourceAccount (additional restrictive conditions like ArnLike are accepted)
  • Optionally, restrict each authorized principal to least-privilege actions using per-principal Deny/NotAction statements (defense-in-depth)

Remediation

CLI

aws secretsmanager put-resource-policy --secret-id <example_resource_id> --resource-policy file://policy.json

Native IaC
Terraform
Other
  1. Open AWS Console > Secrets Manager
  2. Select the secret > Overview tab > Resource permissions > Edit permissions
  3. Add a Deny statement for Principal: * with StringNotEquals condition listing only authorized aws:PrincipalArn values
  4. Add a Deny statement with StringNotEquals on aws:PrincipalOrgID to block access from outside your organization
  5. For each authorized principal, add a Deny with NotAction listing only the specific actions they need
  6. Save the policy

Source Code

Resource Type

AwsSecretsManagerSecret

References