adam/seahaven-org-baseline
1
0
Fork 0
mirror of https://github.com/Sea-Haven-Industries/seahaven-org-baseline.git synced 2026-10-07 16:08:55 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

fix(iam): pin CreateSecret to exact export secret name

Browse source 
Remove CreateSecret and UpdateSecret from the ARN-prefix shell grant so
apply cannot create longer-named secrets or overwrite SecretString.
This commit is contained in:
Adam Moussa 2026-08-05 18:35:30 -04:00
parent 7da9a0de29
commit 21f231e29d
No known key found for this signature in database
1 changed files with 5 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
lib/terraform-substrate/terraform-substrate.template.yaml
View file

@ -891,12 +891,14 @@ Resources:
- iam:ListUsers
- iam:GetAccountSummary
Resource: "*"
# Shell lifecycle only — no GetSecretValue / PutSecretValue so
# apply never renders key material into HCP state or run logs.
# Shell lifecycle only — no GetSecretValue / PutSecretValue /
# UpdateSecret so apply never renders or overwrites key material
# in HCP state or run logs. CreateSecret is only on
# ExportSecretCreate with an exact Name pin (not this ARN
# prefix, which would also match longer secret names).
- Sid: ExportSecretShell
Effect: Allow
Action:
- secretsmanager:CreateSecret
- secretsmanager:DeleteSecret
- secretsmanager:DescribeSecret
- secretsmanager:GetResourcePolicy
@ -904,7 +906,6 @@ Resources:
- secretsmanager:DeleteResourcePolicy
- secretsmanager:TagResource
- secretsmanager:UntagResource
- secretsmanager:UpdateSecret
Resource:
- !Sub "arn:aws:secretsmanager:us-east-1:${AWS::AccountId}:secret:sh-openswe/langsmith-export-s3-*"
- Sid: ExportSecretCreate