rage.fail

aws-secretsmanager-resource-policy-cross-account

explicit aws emits CrossAccountTrust

match (record)

{ "field": "ResourcePolicy", "resource_type": "AWS::SecretsManager::Secret" }

where

a Principal in ResourcePolicy is in a different account than the secret

emit

source	`<ResourcePolicy node of the secret (generic_type ResourcePolicy)>`
target	`<external principal / account>`

Narrative

{secret.name}'s resource policy grants cross-account access to {external.name} in account {account}.

Raw rule rules/explicit/aws-secretsmanager.yaml

id: aws-secretsmanager-resource-policy-cross-account
emits: CrossAccountTrust
applies_to:
- aws
match_record:
  resource_type: AWS::SecretsManager::Secret
  field: ResourcePolicy
where:
- a Principal in ResourcePolicy is in a different account than the secret
emit:
  source: <ResourcePolicy node of the secret (generic_type ResourcePolicy)>
  target: <external principal / account>
  api_source: secretsmanager:GetResourcePolicy
  evidence_field: ResourcePolicy.Statement[].Principal
  narrative: '{secret.name}''s resource policy grants cross-account access to {external.name} in account
    {account}.'
  note: "Honor Deny statements, aws:PrincipalOrgID, and SourceArn conditions. Cross-account GetSecretValue\
    \ also requires the wrapping CMK key policy to grant the external principal kms:Decrypt. The adapter\
    \ MUST emit the source as the secret's ResourcePolicy artifact node (class Policy), never the Secret\
    \ node itself \u2014 a Secret is outside the CrossAccountTrust source set."