From 2f2689b2f953a8d274199cedeb851bfe93363cdb Mon Sep 17 00:00:00 2001 From: Cristian Magherusan-Stanciu Date: Thu, 28 May 2026 20:36:01 +0200 Subject: [PATCH] sec(iac): remove SecretsManagerDescribe wildcard block (closes #430) secretsmanager:ListSecrets on Resource="*" in SecretsManagerDescribe was a duplicate of the ListSecrets already in the SecretsManager block scoped to cudly-* ARNs. The wildcard grant let the CI/CD role enumerate all secret names in the account. Remove the over-privileged statement. --- terraform/environments/aws/ci-cd-permissions/policy_data.tf | 6 ------ 1 file changed, 6 deletions(-) diff --git a/terraform/environments/aws/ci-cd-permissions/policy_data.tf b/terraform/environments/aws/ci-cd-permissions/policy_data.tf index 546d3b37c..eca60627e 100644 --- a/terraform/environments/aws/ci-cd-permissions/policy_data.tf +++ b/terraform/environments/aws/ci-cd-permissions/policy_data.tf @@ -189,12 +189,6 @@ resource "aws_iam_policy" "data" { ] Resource = "arn:aws:secretsmanager:*:*:secret:cudly-*" }, - { - Sid = "SecretsManagerDescribe" - Effect = "Allow" - Action = ["secretsmanager:ListSecrets"] - Resource = "*" - }, { Sid = "S3TerraformState" Effect = "Allow"