rage.fail

aws-secretsmanager-credentials-for

explicit aws emits CredentialsFor

match (record)

{ "field": "OwningService|value_shape|binding", "resource_type": "AWS::SecretsManager::Secret" }

where

the secret's stored value authenticates a specific target principal or datastore, with evidence

emit

source	`<secret node>`
target	`<identity or Data node the credential authenticates>`

Narrative

{secret.name} holds credentials for {target.name}.

Raw rule rules/explicit/aws-secretsmanager.yaml

id: aws-secretsmanager-credentials-for
emits: CredentialsFor
applies_to:
- aws
match_record:
  resource_type: AWS::SecretsManager::Secret
  field: OwningService|value_shape|binding
where:
- the secret's stored value authenticates a specific target principal or datastore, with evidence
emit:
  source: <secret node>
  target: <identity or Data node the credential authenticates>
  api_source: secretsmanager:DescribeSecret (OwningService / tags / evidenced binding)
  evidence_field: OwningService | managed-secret marker | bound principal
  narrative: '{secret.name} holds credentials for {target.name}.'
  note: Emit only with evidence. A rotated/disabled/deleted credential -> do NOT emit (the impersonation/escalation
    chain must not fire). A secret the identity merely owns is not CredentialsFor it. For a managed DB
    secret the target is the Data store; for IAM key material the target is the IAM identity.