aws-secretsmanager-read-value

id: aws-secretsmanager-read-value
kind: state_annotation
annotates: CanReadSecret
description: Sets the existing explicit CanReadSecret edge to ACTIVE when the secret is wrapped by the
  AWS-managed key (transparent same-account decrypt).
match:
- - principal: null
  - CanReadSecret
  - secret: null
where:
- node_class(?secret) == Secret
- ?principal has EFFECTIVE secretsmanager:GetSecretValue on ?secret (identity AND resource policy allow;
  no Deny)
- ?secret.KmsKeyId is the AWS-managed key (alias/aws/secretsmanager) OR unset (defaults to it)
- ?principal.account == ?secret.account
annotation:
  target_edge:
  - principal: null
  - CanReadSecret
  - secret: null
  set_state: ACTIVE
  set_conditions:
  - iam_permission
  - resource_policy
  state_logic: "ACTIVE \u2014 the aws/secretsmanager managed key authorizes decrypt transparently for\
    \ same-account Secrets Manager callers via kms:ViaService; no separate caller decrypt is required.\
    \ BLOCKED if an SCP/resource-policy Deny hits secretsmanager:GetSecretValue."
  derived_from:
  - <explicit CanReadSecret(GetSecretValue) edge_id>
  false_positive_note: "Only mark ACTIVE when the secret uses the AWS-managed aws/secretsmanager key (or\
    \ no KmsKeyId, which defaults to it) AND the caller is same-account. Recon actions (DescribeSecret,\
    \ GetResourcePolicy, ListSecretVersionIds) do NOT return the value \u2014 the explicit edge must never\
    \ have been sourced from them. BatchGetSecretValue is equivalent to GetSecretValue and also qualifies.\
    \ Cross-account reads never use the managed key -> handled by aws-secretsmanager-cross-account-read.\
    \ This rule PRODUCES NO EDGE; it refines the state of the explicit edge in place."
  narrative: '{principal.name} can read the value of {secret.name} (secretsmanager:GetSecretValue); the
    secret uses the AWS-managed key so no additional decrypt permission is needed.'