{
    "api_version": "1",
    "kind": "dse_post",
    "self": "https://update.dsesecurity.com/api/v1/posts/aws-secrets-manager-interface-endpoint-policy-scope/",
    "item": {
        "id": "https://update.dsesecurity.com/updates/aws-secrets-manager-interface-endpoint-policy-scope/",
        "slug": "aws-secrets-manager-interface-endpoint-policy-scope",
        "url": "https://update.dsesecurity.com/updates/aws-secrets-manager-interface-endpoint-policy-scope/",
        "alternate_urls": {
            "markdown": "https://update.dsesecurity.com/updates/aws-secrets-manager-interface-endpoint-policy-scope.md",
            "json": "https://update.dsesecurity.com/api/v1/posts/aws-secrets-manager-interface-endpoint-policy-scope/"
        },
        "title": "Authorize the Secrets Manager endpoint separately from choosing a private route",
        "summary": "A private Secrets Manager connection still needs an endpoint access policy that matches the intended callers and secrets.",
        "format": {
            "slug": "guide",
            "name": "Guide"
        },
        "priority": {
            "slug": "info",
            "name": "Information"
        },
        "featured": false,
        "image": {
            "theme": "managed-it",
            "label": "Managed IT operations",
            "alt": "A controlled technology lifecycle progressing from assessment to approved production.",
            "card_url": "https://update.dsesecurity.com/assets/editorial/managed-it-card.webp?v=1.8.20",
            "hero_url": "https://update.dsesecurity.com/assets/editorial/managed-it-hero.webp?v=1.8.20",
            "social_url": "https://update.dsesecurity.com/assets/editorial/managed-it-social-v2.jpg?v=1.8.20",
            "width": 2400,
            "height": 1350
        },
        "topics": [
            {
                "slug": "business-continuity",
                "name": "Business Continuity",
                "url": "https://update.dsesecurity.com/topic/business-continuity/"
            },
            {
                "slug": "cybersecurity",
                "name": "Cybersecurity",
                "url": "https://update.dsesecurity.com/topic/cybersecurity/"
            },
            {
                "slug": "it",
                "name": "IT",
                "url": "https://update.dsesecurity.com/topic/it/"
            }
        ],
        "author": {
            "name": "DSE Security Editorial Team",
            "url": "https://update.dsesecurity.com/#editorial-team",
            "type": "Organization"
        },
        "publisher": {
            "name": "Detection Systems & Engineering",
            "url": "https://dsesecurity.com/"
        },
        "published_at": "2026-10-20T18:14:18+00:00",
        "modified_at": "2026-10-20T18:34:30+00:00",
        "reviewed_on": "2026-10-20",
        "reading_minutes": 2,
        "word_count": 270,
        "potentially_affected": "This concerns the Secrets Manager interface endpoint. Review endpoint access policies for application and Lambda rotation callers.",
        "dse_recommendation": "DSE recommends mapping each application and rotation function that should use the endpoint.",
        "primary_source": {
            "name": "AWS — Using an AWS Secrets Manager VPC endpoint",
            "url": "https://docs.aws.amazon.com/secretsmanager/latest/userguide/vpc-endpoint-overview.html",
            "published_on": null,
            "authority": "docs.aws.amazon.com"
        },
        "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
        "usage_info": "https://update.dsesecurity.com/usage/",
        "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
        "content_html": "<p>A private Secrets Manager connection still needs an endpoint access policy that matches the intended callers and secrets.</p>\n<h2>Source facts</h2>\n<p>Secrets Manager supports interface VPC endpoints through AWS PrivateLink. With private DNS enabled, applications can use the Region’s normal Secrets Manager hostname through the endpoint. AWS documents a default endpoint policy allowing full Secrets Manager access through that endpoint and allows a custom policy specifying principals, actions and resources. Endpoint routing and endpoint-policy scope are therefore separate configuration choices.</p>\n<p>Source: <a href=\"https://docs.aws.amazon.com/secretsmanager/latest/userguide/vpc-endpoint-overview.html\">AWS — Using an AWS Secrets Manager VPC endpoint</a>.</p>\n<h2>Applicability</h2>\n<p>This concerns the Secrets Manager interface endpoint. Review endpoint access policies for application and Lambda rotation callers.</p>\n<h2>DSE recommendation</h2>\n<p>DSE recommends mapping each application and rotation function that should use the endpoint. Define a narrow endpoint policy using the required actions and secret identifiers, then review it alongside the rest of the access design. Check DNS behavior from the actual workload network. Preserve an approved administrative recovery path before enforcing conditions that could exclude legitimate service calls. Require the network and secret owners to approve the same workload-to-secret access matrix. Keep an endpoint-specific denial in the test plan and identify the recovery contact before tightening policy, so a connectivity incident does not prompt an unreviewed full-access exception.</p>\n<h2>Verification</h2>\n<p>Proposed verification: from an authorized test workload, resolve the regional hostname and inspect the selected endpoint path. Verify retrieval of a permitted test secret and rejection of a secret outside the intended scope. Exercise rotation dependencies separately, retaining metadata and access outcomes while keeping secret values out of the evidence.</p>\n<h2>Official reference</h2>\n<p><a href=\"https://docs.aws.amazon.com/secretsmanager/latest/userguide/vpc-endpoint-overview.html\">AWS — Using an AWS Secrets Manager VPC endpoint</a>. Reviewed October 20, 2026.</p>",
        "content_text": "A private Secrets Manager connection still needs an endpoint access policy that matches the intended callers and secrets.\nSource facts\nSecrets Manager supports interface VPC endpoints through AWS PrivateLink. With private DNS enabled, applications can use the Region’s normal Secrets Manager hostname through the endpoint. AWS documents a default endpoint policy allowing full Secrets Manager access through that endpoint and allows a custom policy specifying principals, actions and resources. Endpoint routing and endpoint-policy scope are therefore separate configuration choices.\nSource: AWS — Using an AWS Secrets Manager VPC endpoint.\nApplicability\nThis concerns the Secrets Manager interface endpoint. Review endpoint access policies for application and Lambda rotation callers.\nDSE recommendation\nDSE recommends mapping each application and rotation function that should use the endpoint. Define a narrow endpoint policy using the required actions and secret identifiers, then review it alongside the rest of the access design. Check DNS behavior from the actual workload network. Preserve an approved administrative recovery path before enforcing conditions that could exclude legitimate service calls. Require the network and secret owners to approve the same workload-to-secret access matrix. Keep an endpoint-specific denial in the test plan and identify the recovery contact before tightening policy, so a connectivity incident does not prompt an unreviewed full-access exception.\nVerification\nProposed verification: from an authorized test workload, resolve the regional hostname and inspect the selected endpoint path. Verify retrieval of a permitted test secret and rejection of a secret outside the intended scope. Exercise rotation dependencies separately, retaining metadata and access outcomes while keeping secret values out of the evidence.\nOfficial reference\nAWS — Using an AWS Secrets Manager VPC endpoint. Reviewed October 20, 2026.",
        "content_markdown": "A private Secrets Manager connection still needs an endpoint access policy that matches the intended callers and secrets.\n\n## Source facts\n\nSecrets Manager supports interface VPC endpoints through AWS PrivateLink. With private DNS enabled, applications can use the Region’s normal Secrets Manager hostname through the endpoint. AWS documents a default endpoint policy allowing full Secrets Manager access through that endpoint and allows a custom policy specifying principals, actions and resources. Endpoint routing and endpoint-policy scope are therefore separate configuration choices.\n\nSource: [AWS — Using an AWS Secrets Manager VPC endpoint](https://docs.aws.amazon.com/secretsmanager/latest/userguide/vpc-endpoint-overview.html).\n\n## Applicability\n\nThis concerns the Secrets Manager interface endpoint. Review endpoint access policies for application and Lambda rotation callers.\n\n## DSE recommendation\n\nDSE recommends mapping each application and rotation function that should use the endpoint. Define a narrow endpoint policy using the required actions and secret identifiers, then review it alongside the rest of the access design. Check DNS behavior from the actual workload network. Preserve an approved administrative recovery path before enforcing conditions that could exclude legitimate service calls. Require the network and secret owners to approve the same workload-to-secret access matrix. Keep an endpoint-specific denial in the test plan and identify the recovery contact before tightening policy, so a connectivity incident does not prompt an unreviewed full-access exception.\n\n## Verification\n\nProposed verification: from an authorized test workload, resolve the regional hostname and inspect the selected endpoint path. Verify retrieval of a permitted test secret and rejection of a secret outside the intended scope. Exercise rotation dependencies separately, retaining metadata and access outcomes while keeping secret values out of the evidence.\n\n## Official reference\n\n[AWS — Using an AWS Secrets Manager VPC endpoint](https://docs.aws.amazon.com/secretsmanager/latest/userguide/vpc-endpoint-overview.html). Reviewed October 20, 2026."
    },
    "json_ld": {
        "@context": "https://schema.org",
        "@graph": [
            {
                "@type": "Organization",
                "@id": "https://dsesecurity.com/#organization",
                "name": "Detection Systems & Engineering",
                "alternateName": "DSE Security",
                "url": "https://dsesecurity.com/",
                "logo": {
                    "@type": "ImageObject",
                    "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20"
                }
            },
            {
                "@type": "Organization",
                "@id": "https://update.dsesecurity.com/#editorial-team",
                "name": "DSE Security Editorial Team",
                "url": "https://update.dsesecurity.com/",
                "parentOrganization": {
                    "@id": "https://dsesecurity.com/#organization"
                }
            },
            {
                "@type": "WebSite",
                "@id": "https://update.dsesecurity.com/#website",
                "name": "DSE Updates",
                "alternateName": "DSE Security Knowledge Hub",
                "url": "https://update.dsesecurity.com/",
                "inLanguage": "en-US",
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "potentialAction": {
                    "@type": "SearchAction",
                    "target": {
                        "@type": "EntryPoint",
                        "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}"
                    },
                    "query-input": "required name=search_term_string"
                }
            },
            {
                "@type": "WebPage",
                "@id": "https://update.dsesecurity.com/updates/aws-secrets-manager-interface-endpoint-policy-scope/",
                "url": "https://update.dsesecurity.com/updates/aws-secrets-manager-interface-endpoint-policy-scope/",
                "isPartOf": {
                    "@id": "https://update.dsesecurity.com/#website"
                },
                "lastReviewed": "2026-10-20"
            },
            {
                "@type": "BreadcrumbList",
                "@id": "https://update.dsesecurity.com/updates/aws-secrets-manager-interface-endpoint-policy-scope/#breadcrumbs",
                "itemListElement": [
                    {
                        "@type": "ListItem",
                        "position": 1,
                        "name": "DSE Updates",
                        "item": "https://update.dsesecurity.com/"
                    },
                    {
                        "@type": "ListItem",
                        "position": 2,
                        "name": "Business Continuity",
                        "item": "https://update.dsesecurity.com/topic/business-continuity/"
                    },
                    {
                        "@type": "ListItem",
                        "position": 3,
                        "name": "Authorize the Secrets Manager endpoint separately from choosing a private route",
                        "item": "https://update.dsesecurity.com/updates/aws-secrets-manager-interface-endpoint-policy-scope/"
                    }
                ]
            },
            {
                "@type": [
                    "Article",
                    "TechArticle"
                ],
                "@id": "https://update.dsesecurity.com/updates/aws-secrets-manager-interface-endpoint-policy-scope/#article",
                "identifier": "https://update.dsesecurity.com/updates/aws-secrets-manager-interface-endpoint-policy-scope/",
                "url": "https://update.dsesecurity.com/updates/aws-secrets-manager-interface-endpoint-policy-scope/",
                "headline": "Authorize the Secrets Manager endpoint separately from choosing a private route",
                "description": "A private Secrets Manager connection still needs an endpoint access policy that matches the intended callers and secrets.",
                "abstract": "A private Secrets Manager connection still needs an endpoint access policy that matches the intended callers and secrets.",
                "articleBody": "A private Secrets Manager connection still needs an endpoint access policy that matches the intended callers and secrets.\nSource facts\nSecrets Manager supports interface VPC endpoints through AWS PrivateLink. With private DNS enabled, applications can use the Region’s normal Secrets Manager hostname through the endpoint. AWS documents a default endpoint policy allowing full Secrets Manager access through that endpoint and allows a custom policy specifying principals, actions and resources. Endpoint routing and endpoint-policy scope are therefore separate configuration choices.\nSource: AWS — Using an AWS Secrets Manager VPC endpoint.\nApplicability\nThis concerns the Secrets Manager interface endpoint. Review endpoint access policies for application and Lambda rotation callers.\nDSE recommendation\nDSE recommends mapping each application and rotation function that should use the endpoint. Define a narrow endpoint policy using the required actions and secret identifiers, then review it alongside the rest of the access design. Check DNS behavior from the actual workload network. Preserve an approved administrative recovery path before enforcing conditions that could exclude legitimate service calls. Require the network and secret owners to approve the same workload-to-secret access matrix. Keep an endpoint-specific denial in the test plan and identify the recovery contact before tightening policy, so a connectivity incident does not prompt an unreviewed full-access exception.\nVerification\nProposed verification: from an authorized test workload, resolve the regional hostname and inspect the selected endpoint path. Verify retrieval of a permitted test secret and rejection of a secret outside the intended scope. Exercise rotation dependencies separately, retaining metadata and access outcomes while keeping secret values out of the evidence.\nOfficial reference\nAWS — Using an AWS Secrets Manager VPC endpoint. Reviewed October 20, 2026.",
                "datePublished": "2026-10-20T18:14:18+00:00",
                "dateModified": "2026-10-20T18:34:30+00:00",
                "mainEntityOfPage": {
                    "@id": "https://update.dsesecurity.com/updates/aws-secrets-manager-interface-endpoint-policy-scope/"
                },
                "inLanguage": "en-US",
                "isAccessibleForFree": true,
                "author": {
                    "@type": "Organization",
                    "name": "DSE Security Editorial Team",
                    "url": "https://update.dsesecurity.com/#editorial-team"
                },
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "image": {
                    "@type": "ImageObject",
                    "@id": "https://update.dsesecurity.com/updates/aws-secrets-manager-interface-endpoint-policy-scope/#primaryimage",
                    "url": "https://update.dsesecurity.com/assets/editorial/managed-it-social-v2.jpg?v=1.8.20",
                    "contentUrl": "https://update.dsesecurity.com/assets/editorial/managed-it-social-v2.jpg?v=1.8.20",
                    "width": 1200,
                    "height": 630,
                    "caption": "Authorize the Secrets Manager endpoint separately from choosing a private route"
                },
                "articleSection": [
                    "Business Continuity",
                    "Cybersecurity",
                    "IT"
                ],
                "keywords": [
                    "Business Continuity",
                    "Cybersecurity",
                    "IT",
                    "Guide",
                    "Information priority"
                ],
                "genre": "Guide",
                "about": [
                    {
                        "@type": "Thing",
                        "name": "Business Continuity",
                        "url": "https://update.dsesecurity.com/topic/business-continuity/"
                    },
                    {
                        "@type": "Thing",
                        "name": "Cybersecurity",
                        "url": "https://update.dsesecurity.com/topic/cybersecurity/"
                    },
                    {
                        "@type": "Thing",
                        "name": "IT",
                        "url": "https://update.dsesecurity.com/topic/it/"
                    }
                ],
                "wordCount": 270,
                "timeRequired": "PT2M",
                "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
                "usageInfo": "https://update.dsesecurity.com/usage/",
                "copyrightHolder": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
                "citation": {
                    "@type": "CreativeWork",
                    "name": "AWS — Using an AWS Secrets Manager VPC endpoint",
                    "url": "https://docs.aws.amazon.com/secretsmanager/latest/userguide/vpc-endpoint-overview.html"
                }
            }
        ]
    }
}