Ravi Sir's Cards › AWS
Least privilege for secrets
This revision card explains Least privilege for secrets. It starts from the need that resource * on GetSecretValue lets one breach read every secret. It describes grant GetSecretValue on specific secret ARNs; separate read from put/rotate roles. The how-to section notes app role — get one secret. Admin role: create/rotate. Deny decrypt of other envs’ CMKs. An example on the card is staging role cannot GetSecretValue on prod/db-password ARN.
Read card text
What this card says
Why do we need it?
Resource * on GetSecretValue lets one breach read every secret.
What is it?
Grant GetSecretValue on specific secret ARNs; separate read from put/rotate roles.
resource ARN
How to do it
App role: get one secret. Admin role: create/rotate. Deny decrypt of other envs’ CMKs.
Example
Staging role cannot GetSecretValue on prod/db-password ARN.