iam_policy_allows_for_data_exfiltration is too restrictive, The is_illegal() function only evaluates the Action, not the Resource. So any IAM statement containing secretsmanager:GetSecretValue will trigger a violation, regardless of whether you specify:
• A specific secret ARN
• A wildcard resource
• Condition keys
Actual Behavior
This should comply but it doesn’t
data "aws_iam_policy_document" "compliant" {
statement {
effect = "Allow"
actions = [
"secretsmanager:GetSecretValue",
"secretsmanager:DescribeSecret"
]
resources = [
"arn:aws:secretsmanager:us-east-1:123456789012:secret:my-app-secret-abc123",
"arn:aws:secretsmanager:us-east-1:123456789012:secret:my-db-password-xyz789"
]
}
}
iam_policy_allows_for_data_exfiltration is too restrictive, The
is_illegal()function only evaluates the Action, not the Resource. So any IAM statement containingsecretsmanager:GetSecretValuewill trigger a violation, regardless of whether you specify:• A specific secret ARN
• A wildcard resource
• Condition keys
Actual Behavior
This should comply but it doesn’t
data "aws_iam_policy_document" "compliant" {
statement {
effect = "Allow"
actions = [
"secretsmanager:GetSecretValue",
"secretsmanager:DescribeSecret"
]
resources = [
"arn:aws:secretsmanager:us-east-1:123456789012:secret:my-app-secret-abc123",
"arn:aws:secretsmanager:us-east-1:123456789012:secret:my-db-password-xyz789"
]
}
}