Back to Checks
gcp

Secret Manager secret is not publicly accessible

secretmanager_secret_not_publicly_accessible
Service: secretmanagerSeverity: critical
OfficialBuilt-inVerified
Categories:internet-exposed
Resource Type:secretmanager.googleapis.com/Secret

Secret Manager secrets deny access to allUsers and allAuthenticatedUsers, so only explicitly authorized identities can read or use them.

The evaluation reviews each secret's IAM policy bindings to confirm no public principals are granted access.

Prowler logoProwlerprowler-provider-gcp

Risk

Granting public IAM access to a secret exposes credentials, API keys, certificates, or other sensitive values to any caller on the internet or any authenticated Google account. This compromises confidentiality, enables lateral movement with leaked credentials, and can trigger regulatory breaches under PCI-DSS, ISO 27001, and GDPR.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler gcp --checks secretmanager_secret_not_publicly_accessible

Recommendation

Apply least privilege to Secret Manager: grant roles/secretmanager.secretAccessor only to the specific service accounts or groups that need to read each secret.

Use workload identity for GKE workloads and rotate credentials regularly to limit blast radius when a binding is misconfigured.

Remediation

CLI

gcloud secrets remove-iam-policy-binding <SECRET_NAME> --member=<allUsers|allAuthenticatedUsers> --role=roles/secretmanager.secretAccessor

Terraform

resource "google_secret_manager_secret_iam_binding" "<example_resource_name>" {
  secret_id = "<example_resource_id>"
  role      = "roles/secretmanager.secretAccessor"
  members   = ["serviceAccount:<example_resource_id>"] # Critical: never include allUsers or allAuthenticatedUsers
}

Other

1In Google Cloud Console, go to Security > Secret Manager
2Select the secret and open the Permissions tab
3Remove any binding with allUsers or allAuthenticatedUsers
4Grant access only to required service accounts or groups

Check Code

from prowler.lib.check.models import Check, Check_Report_GCP
from prowler.providers.gcp.services.secretmanager.secretmanager_client import (
    secretmanager_client,
)


class secretmanager_secret_not_publicly_accessible(Check):
    """Check that Secret Manager secrets do not grant access to all users.

    Verifies that no Secret Manager secret has an IAM binding granting access
    to `allUsers` or `allAuthenticatedUsers`.
    """

    def execute(self) -> list[Check_Report_GCP]:
        """Execute the public-access check across all Secret Manager secrets.

        Returns:
            A list of `Check_Report_GCP` findings, one per secret. Status is
            `FAIL` when the secret is accessible to `allUsers` or
            `allAuthenticatedUsers` and `PASS` otherwise.
        """
        findings = []
        for secret in secretmanager_client.secrets:
            report = Check_Report_GCP(
                metadata=self.metadata(),
                resource=secret,
                resource_id=secret.name,
            )
            if secret.publicly_accessible:
                report.status = "FAIL"
                report.status_extended = (
                    f"Secret {secret.name} is publicly accessible "
                    f"(allUsers or allAuthenticatedUsers IAM binding detected)."
                )
            else:
                report.status = "PASS"
                report.status_extended = (
                    f"Secret {secret.name} is not publicly accessible."
                )
            findings.append(report)
        return findings

References