Secrets Manager secret resource policy blocks public access

# Restrict secret policy and block public access
resource "aws_secretsmanager_secret_policy" "<example_resource_name>" {
  secret_arn         = "<example_resource_id>"
  block_public_policy = true  # Critical: blocks public policies
  policy = jsonencode({       # Critical: principal is not "*"
    Version = "2012-10-17"
    Statement = [{
      Effect    = "Allow"
      Principal = { AWS = "arn:aws:iam::<ACCOUNT_ID>:root" }
      Action    = "secretsmanager:GetSecretValue"
      Resource  = "*"
    }]
  })
}

# CloudFormation: attach a non-public resource policy
Resources:
  <example_resource_name>:
    Type: AWS::SecretsManager::ResourcePolicy
    Properties:
      SecretId: "<example_resource_id>"
      BlockPublicPolicy: true  # Critical: prevents policies that allow public access
      ResourcePolicy:          # Critical: principal is restricted, not "*"
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              AWS: arn:aws:iam::<ACCOUNT_ID>:root
            Action: secretsmanager:GetSecretValue
            Resource: "*"