# Authorize the Secrets Manager endpoint separately from choosing a private route

> A private Secrets Manager connection still needs an endpoint access policy that matches the intended callers and secrets.

- Canonical URL: https://update.dsesecurity.com/updates/aws-secrets-manager-interface-endpoint-policy-scope/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-10-20T18:14:18+00:00
- Modified: 2026-10-20T18:34:30+00:00
- Last reviewed by DSE: 2026-10-20
- Resource type: Guide
- DSE priority: Information
- Topics: Business Continuity, Cybersecurity, IT
- Reading time: 2 minutes

## What you need to know

A private Secrets Manager connection still needs an endpoint access policy that matches the intended callers and secrets.

## Potentially affected

This concerns the Secrets Manager interface endpoint. Review endpoint access policies for application and Lambda rotation callers.

## DSE recommendation

DSE recommends mapping each application and rotation function that should use the endpoint.

## Article

A private Secrets Manager connection still needs an endpoint access policy that matches the intended callers and secrets.

## Source facts

Secrets Manager supports interface VPC endpoints through AWS PrivateLink. With private DNS enabled, applications can use the Region’s normal Secrets Manager hostname through the endpoint. AWS documents a default endpoint policy allowing full Secrets Manager access through that endpoint and allows a custom policy specifying principals, actions and resources. Endpoint routing and endpoint-policy scope are therefore separate configuration choices.

Source: [AWS — Using an AWS Secrets Manager VPC endpoint](https://docs.aws.amazon.com/secretsmanager/latest/userguide/vpc-endpoint-overview.html).

## Applicability

This concerns the Secrets Manager interface endpoint. Review endpoint access policies for application and Lambda rotation callers.

## DSE recommendation

DSE recommends mapping each application and rotation function that should use the endpoint. Define a narrow endpoint policy using the required actions and secret identifiers, then review it alongside the rest of the access design. Check DNS behavior from the actual workload network. Preserve an approved administrative recovery path before enforcing conditions that could exclude legitimate service calls. Require the network and secret owners to approve the same workload-to-secret access matrix. Keep an endpoint-specific denial in the test plan and identify the recovery contact before tightening policy, so a connectivity incident does not prompt an unreviewed full-access exception.

## Verification

Proposed verification: from an authorized test workload, resolve the regional hostname and inspect the selected endpoint path. Verify retrieval of a permitted test secret and rejection of a secret outside the intended scope. Exercise rotation dependencies separately, retaining metadata and access outcomes while keeping secret values out of the evidence.

## Official reference

[AWS — Using an AWS Secrets Manager VPC endpoint](https://docs.aws.amazon.com/secretsmanager/latest/userguide/vpc-endpoint-overview.html). Reviewed October 20, 2026.

## Primary reference

- Name: AWS — Using an AWS Secrets Manager VPC endpoint
- Authority: docs.aws.amazon.com
- URL: https://docs.aws.amazon.com/secretsmanager/latest/userguide/vpc-endpoint-overview.html
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Authorize the Secrets Manager endpoint separately from choosing a private route,” DSE Security, https://update.dsesecurity.com/updates/aws-secrets-manager-interface-endpoint-policy-scope/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.