rage.fail

aws-secretsmanager-can-read-metadata

explicit aws emits CanRead

match (effective permission)

{ "action": "secretsmanager:DescribeSecret", "resource_type": "AWS::SecretsManager::Secret" }

emit

source type	`Identity`
target type	`*`
source	`<principal>`
target	`<secret node>`
permissions	`secretsmanager:DescribeSecret`

Narrative

{principal.name} can read metadata of {secret.name} (secretsmanager:DescribeSecret) - no value.

Raw rule rules/explicit/aws-secretsmanager.yaml

id: aws-secretsmanager-can-read-metadata
emits: CanRead
applies_to:
- aws
match_effective_permission:
  action: secretsmanager:DescribeSecret
  resource_type: AWS::SecretsManager::Secret
emit:
  source_type: Identity
  target_type: '*'
  source: <principal>
  target: <secret node>
  permissions:
  - secretsmanager:DescribeSecret
  narrative: "{principal.name} can read metadata of {secret.name} (secretsmanager:DescribeSecret) \u2014\
    \ no value."