rage.fail

aws-secretsmanager-can-modify-value

explicit aws emits CanModifyConfiguration

match (effective permission)

{ "action": "secretsmanager:PutSecretValue", "resource_type": "AWS::SecretsManager::Secret" }

emit

source type	`Identity`
target type	`*`
source	`<principal>`
target	`<secret node>`
permissions	`secretsmanager:PutSecretValue` `secretsmanager:UpdateSecret`

Narrative

{principal.name} can overwrite the value of {secret.name} (secretsmanager:PutSecretValue).

Raw rule rules/explicit/aws-secretsmanager.yaml

id: aws-secretsmanager-can-modify-value
emits: CanModifyConfiguration
applies_to:
- aws
match_effective_permission:
  action: secretsmanager:PutSecretValue
  resource_type: AWS::SecretsManager::Secret
emit:
  source_type: Identity
  target_type: '*'
  source: <principal>
  target: <secret node>
  permissions:
  - secretsmanager:PutSecretValue
  - secretsmanager:UpdateSecret
  narrative: '{principal.name} can overwrite the value of {secret.name} (secretsmanager:PutSecretValue).'