{
    "api_version": "1",
    "kind": "dse_post",
    "self": "https://update.dsesecurity.com/api/v1/posts/aws-secrets-manager-block-public-policy-review-boundary/",
    "item": {
        "id": "https://update.dsesecurity.com/updates/aws-secrets-manager-block-public-policy-review-boundary/",
        "slug": "aws-secrets-manager-block-public-policy-review-boundary",
        "url": "https://update.dsesecurity.com/updates/aws-secrets-manager-block-public-policy-review-boundary/",
        "alternate_urls": {
            "markdown": "https://update.dsesecurity.com/updates/aws-secrets-manager-block-public-policy-review-boundary.md",
            "json": "https://update.dsesecurity.com/api/v1/posts/aws-secrets-manager-block-public-policy-review-boundary/"
        },
        "title": "Review IAM and key policies alongside Secrets Manager public-policy checks",
        "summary": "A resource-policy validation result covers one access path rather than every permission affecting a secret.",
        "format": {
            "slug": "guide",
            "name": "Guide"
        },
        "priority": {
            "slug": "info",
            "name": "Information"
        },
        "featured": false,
        "image": {
            "theme": "continuity-recovery",
            "label": "Continuity & recovery",
            "alt": "Paired infrastructure paths converging on a stable recovered service.",
            "card_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-card.webp?v=1.8.20",
            "hero_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-hero.webp?v=1.8.20",
            "social_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20",
            "width": 2400,
            "height": 1350
        },
        "topics": [
            {
                "slug": "business-continuity",
                "name": "Business Continuity",
                "url": "https://update.dsesecurity.com/topic/business-continuity/"
            },
            {
                "slug": "cybersecurity",
                "name": "Cybersecurity",
                "url": "https://update.dsesecurity.com/topic/cybersecurity/"
            },
            {
                "slug": "it",
                "name": "IT",
                "url": "https://update.dsesecurity.com/topic/it/"
            }
        ],
        "author": {
            "name": "DSE Security Editorial Team",
            "url": "https://update.dsesecurity.com/#editorial-team",
            "type": "Organization"
        },
        "publisher": {
            "name": "Detection Systems & Engineering",
            "url": "https://dsesecurity.com/"
        },
        "published_at": "2026-10-20T18:14:17+00:00",
        "modified_at": "2026-10-20T18:34:30+00:00",
        "reviewed_on": "2026-10-20",
        "reading_minutes": 2,
        "word_count": 270,
        "potentially_affected": "This concerns Secrets Manager resource-based policy validation. It does not assert that a particular policy combination is safe, or replace reviewing the actual principals, actions and encryption-key access.",
        "dse_recommendation": "DSE recommends listing intended readers and administrators before writing the secret policy.",
        "primary_source": {
            "name": "AWS — Resource-based policies",
            "url": "https://docs.aws.amazon.com/secretsmanager/latest/userguide/auth-and-access_resource-policies.html",
            "published_on": null,
            "authority": "docs.aws.amazon.com"
        },
        "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
        "usage_info": "https://update.dsesecurity.com/usage/",
        "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
        "content_html": "<p>A resource-policy validation result covers one access path rather than every permission affecting a secret.</p>\n<h2>Source facts</h2>\n<p>Secrets Manager validates resource policies attached in its console and offers BlockPublicPolicy for API or CLI use. AWS says these checks help prevent public access through policies directly attached to the secret. It also instructs administrators to inspect associated identity policies and resource policies on related resources, including KMS keys. An attached-policy check is therefore not a complete effective-access review.</p>\n<p>Source: <a href=\"https://docs.aws.amazon.com/secretsmanager/latest/userguide/auth-and-access_resource-policies.html\">AWS — Resource-based policies</a>.</p>\n<h2>Applicability</h2>\n<p>This concerns Secrets Manager resource-based policy validation. It does not assert that a particular policy combination is safe, or replace reviewing the actual principals, actions and encryption-key access.</p>\n<h2>DSE recommendation</h2>\n<p>DSE recommends listing intended readers and administrators before writing the secret policy. Review the secret’s policy, relevant role policies and key permissions as one access path. Keep cross-account grants explicit and preserve the previous policy for an approved rollback. Use validation as an additional gate while retaining a human review of the complete intended access boundary. Have a reviewer trace one intended reader through all relevant permission layers and explain the expected deny case. Preserve that access matrix with the validation result so future reviewers understand the intended boundary instead of treating a passed policy check as the entire approval.</p>\n<h2>Verification</h2>\n<p>Proposed verification: in an approved test setup, validate the proposed resource policy and compare access for an intended role and an unapproved role. Record the evaluated secret and key identifiers without revealing values. Retain effective-policy findings and explain any denied request before broadening a policy to make it succeed.</p>\n<h2>Official reference</h2>\n<p><a href=\"https://docs.aws.amazon.com/secretsmanager/latest/userguide/auth-and-access_resource-policies.html\">AWS — Resource-based policies</a>. Reviewed October 20, 2026.</p>",
        "content_text": "A resource-policy validation result covers one access path rather than every permission affecting a secret.\nSource facts\nSecrets Manager validates resource policies attached in its console and offers BlockPublicPolicy for API or CLI use. AWS says these checks help prevent public access through policies directly attached to the secret. It also instructs administrators to inspect associated identity policies and resource policies on related resources, including KMS keys. An attached-policy check is therefore not a complete effective-access review.\nSource: AWS — Resource-based policies.\nApplicability\nThis concerns Secrets Manager resource-based policy validation. It does not assert that a particular policy combination is safe, or replace reviewing the actual principals, actions and encryption-key access.\nDSE recommendation\nDSE recommends listing intended readers and administrators before writing the secret policy. Review the secret’s policy, relevant role policies and key permissions as one access path. Keep cross-account grants explicit and preserve the previous policy for an approved rollback. Use validation as an additional gate while retaining a human review of the complete intended access boundary. Have a reviewer trace one intended reader through all relevant permission layers and explain the expected deny case. Preserve that access matrix with the validation result so future reviewers understand the intended boundary instead of treating a passed policy check as the entire approval.\nVerification\nProposed verification: in an approved test setup, validate the proposed resource policy and compare access for an intended role and an unapproved role. Record the evaluated secret and key identifiers without revealing values. Retain effective-policy findings and explain any denied request before broadening a policy to make it succeed.\nOfficial reference\nAWS — Resource-based policies. Reviewed October 20, 2026.",
        "content_markdown": "A resource-policy validation result covers one access path rather than every permission affecting a secret.\n\n## Source facts\n\nSecrets Manager validates resource policies attached in its console and offers BlockPublicPolicy for API or CLI use. AWS says these checks help prevent public access through policies directly attached to the secret. It also instructs administrators to inspect associated identity policies and resource policies on related resources, including KMS keys. An attached-policy check is therefore not a complete effective-access review.\n\nSource: [AWS — Resource-based policies](https://docs.aws.amazon.com/secretsmanager/latest/userguide/auth-and-access_resource-policies.html).\n\n## Applicability\n\nThis concerns Secrets Manager resource-based policy validation. It does not assert that a particular policy combination is safe, or replace reviewing the actual principals, actions and encryption-key access.\n\n## DSE recommendation\n\nDSE recommends listing intended readers and administrators before writing the secret policy. Review the secret’s policy, relevant role policies and key permissions as one access path. Keep cross-account grants explicit and preserve the previous policy for an approved rollback. Use validation as an additional gate while retaining a human review of the complete intended access boundary. Have a reviewer trace one intended reader through all relevant permission layers and explain the expected deny case. Preserve that access matrix with the validation result so future reviewers understand the intended boundary instead of treating a passed policy check as the entire approval.\n\n## Verification\n\nProposed verification: in an approved test setup, validate the proposed resource policy and compare access for an intended role and an unapproved role. Record the evaluated secret and key identifiers without revealing values. Retain effective-policy findings and explain any denied request before broadening a policy to make it succeed.\n\n## Official reference\n\n[AWS — Resource-based policies](https://docs.aws.amazon.com/secretsmanager/latest/userguide/auth-and-access_resource-policies.html). Reviewed October 20, 2026."
    },
    "json_ld": {
        "@context": "https://schema.org",
        "@graph": [
            {
                "@type": "Organization",
                "@id": "https://dsesecurity.com/#organization",
                "name": "Detection Systems & Engineering",
                "alternateName": "DSE Security",
                "url": "https://dsesecurity.com/",
                "logo": {
                    "@type": "ImageObject",
                    "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20"
                }
            },
            {
                "@type": "Organization",
                "@id": "https://update.dsesecurity.com/#editorial-team",
                "name": "DSE Security Editorial Team",
                "url": "https://update.dsesecurity.com/",
                "parentOrganization": {
                    "@id": "https://dsesecurity.com/#organization"
                }
            },
            {
                "@type": "WebSite",
                "@id": "https://update.dsesecurity.com/#website",
                "name": "DSE Updates",
                "alternateName": "DSE Security Knowledge Hub",
                "url": "https://update.dsesecurity.com/",
                "inLanguage": "en-US",
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "potentialAction": {
                    "@type": "SearchAction",
                    "target": {
                        "@type": "EntryPoint",
                        "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}"
                    },
                    "query-input": "required name=search_term_string"
                }
            },
            {
                "@type": "WebPage",
                "@id": "https://update.dsesecurity.com/updates/aws-secrets-manager-block-public-policy-review-boundary/",
                "url": "https://update.dsesecurity.com/updates/aws-secrets-manager-block-public-policy-review-boundary/",
                "isPartOf": {
                    "@id": "https://update.dsesecurity.com/#website"
                },
                "lastReviewed": "2026-10-20"
            },
            {
                "@type": "BreadcrumbList",
                "@id": "https://update.dsesecurity.com/updates/aws-secrets-manager-block-public-policy-review-boundary/#breadcrumbs",
                "itemListElement": [
                    {
                        "@type": "ListItem",
                        "position": 1,
                        "name": "DSE Updates",
                        "item": "https://update.dsesecurity.com/"
                    },
                    {
                        "@type": "ListItem",
                        "position": 2,
                        "name": "Business Continuity",
                        "item": "https://update.dsesecurity.com/topic/business-continuity/"
                    },
                    {
                        "@type": "ListItem",
                        "position": 3,
                        "name": "Review IAM and key policies alongside Secrets Manager public-policy checks",
                        "item": "https://update.dsesecurity.com/updates/aws-secrets-manager-block-public-policy-review-boundary/"
                    }
                ]
            },
            {
                "@type": [
                    "Article",
                    "TechArticle"
                ],
                "@id": "https://update.dsesecurity.com/updates/aws-secrets-manager-block-public-policy-review-boundary/#article",
                "identifier": "https://update.dsesecurity.com/updates/aws-secrets-manager-block-public-policy-review-boundary/",
                "url": "https://update.dsesecurity.com/updates/aws-secrets-manager-block-public-policy-review-boundary/",
                "headline": "Review IAM and key policies alongside Secrets Manager public-policy checks",
                "description": "A resource-policy validation result covers one access path rather than every permission affecting a secret.",
                "abstract": "A resource-policy validation result covers one access path rather than every permission affecting a secret.",
                "articleBody": "A resource-policy validation result covers one access path rather than every permission affecting a secret.\nSource facts\nSecrets Manager validates resource policies attached in its console and offers BlockPublicPolicy for API or CLI use. AWS says these checks help prevent public access through policies directly attached to the secret. It also instructs administrators to inspect associated identity policies and resource policies on related resources, including KMS keys. An attached-policy check is therefore not a complete effective-access review.\nSource: AWS — Resource-based policies.\nApplicability\nThis concerns Secrets Manager resource-based policy validation. It does not assert that a particular policy combination is safe, or replace reviewing the actual principals, actions and encryption-key access.\nDSE recommendation\nDSE recommends listing intended readers and administrators before writing the secret policy. Review the secret’s policy, relevant role policies and key permissions as one access path. Keep cross-account grants explicit and preserve the previous policy for an approved rollback. Use validation as an additional gate while retaining a human review of the complete intended access boundary. Have a reviewer trace one intended reader through all relevant permission layers and explain the expected deny case. Preserve that access matrix with the validation result so future reviewers understand the intended boundary instead of treating a passed policy check as the entire approval.\nVerification\nProposed verification: in an approved test setup, validate the proposed resource policy and compare access for an intended role and an unapproved role. Record the evaluated secret and key identifiers without revealing values. Retain effective-policy findings and explain any denied request before broadening a policy to make it succeed.\nOfficial reference\nAWS — Resource-based policies. Reviewed October 20, 2026.",
                "datePublished": "2026-10-20T18:14:17+00:00",
                "dateModified": "2026-10-20T18:34:30+00:00",
                "mainEntityOfPage": {
                    "@id": "https://update.dsesecurity.com/updates/aws-secrets-manager-block-public-policy-review-boundary/"
                },
                "inLanguage": "en-US",
                "isAccessibleForFree": true,
                "author": {
                    "@type": "Organization",
                    "name": "DSE Security Editorial Team",
                    "url": "https://update.dsesecurity.com/#editorial-team"
                },
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "image": {
                    "@type": "ImageObject",
                    "@id": "https://update.dsesecurity.com/updates/aws-secrets-manager-block-public-policy-review-boundary/#primaryimage",
                    "url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20",
                    "contentUrl": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20",
                    "width": 1200,
                    "height": 630,
                    "caption": "Review IAM and key policies alongside Secrets Manager public-policy checks"
                },
                "articleSection": [
                    "Business Continuity",
                    "Cybersecurity",
                    "IT"
                ],
                "keywords": [
                    "Business Continuity",
                    "Cybersecurity",
                    "IT",
                    "Guide",
                    "Information priority"
                ],
                "genre": "Guide",
                "about": [
                    {
                        "@type": "Thing",
                        "name": "Business Continuity",
                        "url": "https://update.dsesecurity.com/topic/business-continuity/"
                    },
                    {
                        "@type": "Thing",
                        "name": "Cybersecurity",
                        "url": "https://update.dsesecurity.com/topic/cybersecurity/"
                    },
                    {
                        "@type": "Thing",
                        "name": "IT",
                        "url": "https://update.dsesecurity.com/topic/it/"
                    }
                ],
                "wordCount": 270,
                "timeRequired": "PT2M",
                "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
                "usageInfo": "https://update.dsesecurity.com/usage/",
                "copyrightHolder": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
                "citation": {
                    "@type": "CreativeWork",
                    "name": "AWS — Resource-based policies",
                    "url": "https://docs.aws.amazon.com/secretsmanager/latest/userguide/auth-and-access_resource-policies.html"
                }
            }
        ]
    }
}