Secrets Manager secret has a restrictive resource policy

Check ID: secretsmanager_has_restrictive_resource_policy
Provider: AWS
Service: secretsmanager
Severity: HIGH
Categories: secrets, trust-boundaries
Resource type: AwsSecretsManagerSecret

What this check verifies

Secrets Manager secrets are evaluated for restrictive resource-based policies: explicit Deny for unauthorized principals, Organization boundary via PrincipalOrgID, aws:SourceAccount for service access. Per-principal NotAction restrictions are optional (defense-in-depth). Regionalized service principals are supported.

Risk

Without a restrictive resource policy, any IAM principal in the account—or even cross-account entities—can read, modify, or delete the secret, compromising confidentiality and integrity. Overly broad policies enable lateral movement and privilege escalation through exposed credentials.

Recommendation

Apply deny-by-default resource policies to every secret:

Deny all principals except explicitly authorized roles via StringNotEquals on aws:PrincipalArn
Deny access from outside the AWS Organization via aws:PrincipalOrgID
Constrain AWS service access with aws:SourceAccount (additional restrictive conditions like ArnLike are accepted)
Optionally, restrict each authorized principal to least-privilege actions using per-principal Deny/NotAction statements (defense-in-depth)

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws secretsmanager put-resource-policy —secret-id <example_resource_id> —resource-policy file://policy.json

resource "aws_secretsmanager_secret_policy" "<example_resource_name>" {
  secret_arn = "<example_resource_id>"
  policy = jsonencode({  # Critical: deny-by-default with explicit exceptions
    Version = "2012-10-17"
    Statement = [
      {
        Effect    = "Deny"
        Principal = "*"
        Action    = "*"
        Resource  = "*"
        Condition = {
          StringNotEquals = {
            "aws:PrincipalArn" = ["<AUTHORIZED_ROLE_ARN>"]
          }
        }
      }
    ]
  })
}

Resources:
  <example_resource_name>:
    Type: AWS::SecretsManager::ResourcePolicy
    Properties:
      SecretId: <example_resource_id>
      ResourcePolicy:  # Critical: deny-by-default with explicit exceptions
        Version: '2012-10-17'
        Statement:
          - Effect: Deny
            Principal: '*'
            Action: '*'
            Resource: '*'
            Condition:
              StringNotEquals:
                aws:PrincipalArn: <AUTHORIZED_ROLE_ARN>

Open AWS Console > Secrets Manager
Select the secret > Overview tab > Resource permissions > Edit permissions
Add a Deny statement for Principal: * with StringNotEquals condition listing only authorized aws:PrincipalArn values
Add a Deny statement with StringNotEquals on aws:PrincipalOrgID to block access from outside your organization
For each authorized principal, add a Deny with NotAction listing only the specific actions they need
Save the policy

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = secretsmanager_has_restrictive_resource_policy. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

Secrets Manager secret has rotation enabled Secrets Manager secret resource policy blocks public access

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires