Ensure that inline policy does not expose secrets in AWS Secrets Manager

HIGH

Description

Organizations should ensure that proper restrictions are set on Secrets within Secrets Manager so that they are not inadvertently exposed. This can be done using inline IAM policies within Secrets Manager. For more information, see the AWS documentation.
References:
https://docs.aws.amazon.com/secretsmanager/latest/userguide/auth-and-access_examples.html

Remediation

In AWS Console -

  1. Sign in to the AWS console and go to the Secrets Manager console.
  2. In the Navigation pane, select Secrets.
  3. In the list of Secrets, select the secret to edit.
  4. In Resource permissions box, select Edit Permissions and add an IAM policy accordingly.
  5. Select Save.

In Terraform -

  1. Review the policy attached to the aws_secretsmanager_secret resource and ensure necessary changes are made.

References:
https://docs.aws.amazon.com/secretsmanager/latest/userguide/auth-and-access_examples.html
https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/secretsmanager_secret

Policy Details

Rule Reference ID: AC_AWS_0386
CSP: AWS
Remediation Available: Yes
Resource Category: Management
Resource Type: Secrets Manager

Frameworks