rage.fail

aws-secretsmanager-wrapped-by-key

explicit aws emits HasPolicy

match (record)

{ "field": "KmsKeyId", "resource_type": "AWS::SecretsManager::Secret" }

where

KmsKeyId present (defaults to alias/aws/secretsmanager when unset)

emit

source type	`*`
target type	`Policy`
source	`<secret node>`
target	`<KMS key policy artifact for KmsKeyId (Policy node)>`

Narrative

{secret.name} is encrypted by KMS key {key.name} (KmsKeyId); its key policy gates decrypt.

Raw rule rules/explicit/aws-secretsmanager.yaml

id: aws-secretsmanager-wrapped-by-key
emits: HasPolicy
applies_to:
- aws
match_record:
  resource_type: AWS::SecretsManager::Secret
  field: KmsKeyId
where:
- KmsKeyId present (defaults to alias/aws/secretsmanager when unset)
emit:
  source_type: '*'
  target_type: Policy
  source: <secret node>
  target: <KMS key policy artifact for KmsKeyId (Policy node)>
  api_source: secretsmanager:DescribeSecret + kms:GetKeyPolicy
  evidence_field: KmsKeyId
  record_property:
    node: <secret node>
    key: encrypted_by
    value: <KmsKeyId>
  narrative: '{secret.name} is encrypted by KMS key {key.name} (KmsKeyId); its key policy gates decrypt.'
  note: Sets secret.encrypted_by / kms_key_id, consumed by wraps(?key,?secret) in decrypt-gates-secret-read,
    and links the KMS key's Policy artifact (HasPolicy, source ["*"]) so the evaluator can read the key
    policy. If KmsKeyId is the AWS-managed alias (alias/aws/secretsmanager) the reader needs no separate
    decrypt permission (same-account); a customer CMK makes CanReadSecret CONDITIONAL(key_permission).