Back to Checks
aws

Secrets Manager secret resource policy does not allow public access

secretsmanager_not_publicly_accessible
Service: secretsmanagerSeverity: high
OfficialBuilt-inVerified
Categories:internet-exposedsecrets
Resource Type:AwsSecretsManagerSecret

AWS Secrets Manager secrets are evaluated for public exposure through resource-based policies that grant broad access, such as Principal: "*", which would allow any principal to perform actions on the secret.

Prowler logoProwlerprowler-provider-aws

Risk

Public access to a secret enables uncontrolled retrieval of secret values, compromising confidentiality. If broad actions are allowed, attackers can modify or delete the secret, impacting integrity and availability, and use exposed credentials for unauthorized data access and lateral movement.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks secretsmanager_not_publicly_accessible

Recommendation

Apply least privilege to resource policies:

  • Remove wildcards and limit access to specific principals
  • Add contextual conditions (e.g., VPC endpoints, source account/ARN)
  • Enable safeguards that block public policies
  • Prefer private access paths
  • Periodically review related identity and KMS policies

Remediation

CLI

aws secretsmanager put-resource-policy --secret-id <secret-id> --resource-policy '{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"AWS":"arn:aws:iam::<ACCOUNT_ID>:root"},"Action":"secretsmanager:GetSecretValue","Resource":"*"}]}' --block-public-policy

Terraform

# Restrict secret policy and block public access
resource "aws_secretsmanager_secret_policy" "<example_resource_name>" {
  secret_arn         = "<example_resource_id>"
  block_public_policy = true  # Critical: blocks public policies
  policy = jsonencode({       # Critical: principal is not "*"
    Version = "2012-10-17"
    Statement = [{
      Effect    = "Allow"
      Principal = { AWS = "arn:aws:iam::<ACCOUNT_ID>:root" }
      Action    = "secretsmanager:GetSecretValue"
      Resource  = "*"
    }]
  })
}

NativeIaC

# CloudFormation: attach a non-public resource policy
Resources:
  <example_resource_name>:
    Type: AWS::SecretsManager::ResourcePolicy
    Properties:
      SecretId: "<example_resource_id>"
      BlockPublicPolicy: true  # Critical: prevents policies that allow public access
      ResourcePolicy:          # Critical: principal is restricted, not "*"
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              AWS: arn:aws:iam::<ACCOUNT_ID>:root
            Action: secretsmanager:GetSecretValue
            Resource: "*"

Other

1Open AWS Console > Secrets Manager
2Select the secret > Overview tab > Resource permissions > Edit permissions
3Remove any statement with Principal set to "*" (or AWS: "*")
4Add an allow statement for only your account root principal: arn:aws:iam::<ACCOUNT_ID>:root
5Enable Block public access (if available) and click Save

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.iam.lib.policy import is_policy_public
from prowler.providers.aws.services.secretsmanager.secretsmanager_client import (
    secretsmanager_client,
)


class secretsmanager_not_publicly_accessible(Check):
    def execute(self):
        findings = []
        for secret in secretsmanager_client.secrets.values():
            if secret.policy is None:
                continue
            report = Check_Report_AWS(metadata=self.metadata(), resource=secret)
            report.status = "PASS"
            report.status_extended = (
                f"SecretsManager secret {secret.name} is not publicly accessible."
            )
            if is_policy_public(
                secret.policy,
                secretsmanager_client.audited_account,
            ):
                report.status = "FAIL"
                report.status_extended = f"SecretsManager secret {secret.name} is publicly accessible due to its resource policy."

            findings.append(report)

        return findings

References