Review IAM and key policies alongside Secrets Manager public-policy checks

A resource-policy validation result covers one access path rather than every permission affecting a secret.

Source facts

Secrets Manager validates resource policies attached in its console and offers BlockPublicPolicy for API or CLI use. AWS says these checks help prevent public access through policies directly attached to the secret. It also instructs administrators to inspect associated identity policies and resource policies on related resources, including KMS keys. An attached-policy check is therefore not a complete effective-access review.

Source: AWS — Resource-based policies.

Applicability

This concerns Secrets Manager resource-based policy validation. It does not assert that a particular policy combination is safe, or replace reviewing the actual principals, actions and encryption-key access.

DSE recommendation

DSE recommends listing intended readers and administrators before writing the secret policy. Review the secret’s policy, relevant role policies and key permissions as one access path. Keep cross-account grants explicit and preserve the previous policy for an approved rollback. Use validation as an additional gate while retaining a human review of the complete intended access boundary. Have a reviewer trace one intended reader through all relevant permission layers and explain the expected deny case. Preserve that access matrix with the validation result so future reviewers understand the intended boundary instead of treating a passed policy check as the entire approval.

Verification

Proposed verification: in an approved test setup, validate the proposed resource policy and compare access for an intended role and an unapproved role. Record the evaluated secret and key identifiers without revealing values. Retain effective-policy findings and explain any denied request before broadening a policy to make it succeed.

Official reference

AWS — Resource-based policies. Reviewed October 20, 2026.