rage.fail

aws-secretsmanager-can-read-secret

explicit aws emits CanReadSecret

match (effective permission)

{ "action": "secretsmanager:GetSecretValue", "resource_type": "AWS::SecretsManager::Secret" }

emit

source	`<principal>`
target	`<secret node>`
permissions	`secretsmanager:GetSecretValue`

Narrative

{principal.name} can read the value of {secret.name} (secretsmanager:GetSecretValue).

Raw rule rules/explicit/aws-secretsmanager.yaml

id: aws-secretsmanager-can-read-secret
emits: CanReadSecret
applies_to:
- aws
match_effective_permission:
  action: secretsmanager:GetSecretValue
  resource_type: AWS::SecretsManager::Secret
emit:
  source: <principal>
  target: <secret node>
  api_source: iam:SimulatePrincipalPolicy | policy evaluation
  permissions:
  - secretsmanager:GetSecretValue
  evidence_field: effective secretsmanager:GetSecretValue on secret ARN
  narrative: '{principal.name} can read the value of {secret.name} (secretsmanager:GetSecretValue).'
  note: BatchGetSecretValue is equivalent and should also produce this edge. The derived rules apply the
    KMS key_permission gate (CMK vs aws/secretsmanager) and set ACTIVE/CONDITIONAL. Recon actions (DescribeSecret,
    GetResourcePolicy, ListSecretVersionIds) do NOT return the value and must NOT emit this edge.