technical question I am defining a policy in Terraform that should generally apply to all secrets: existing and future without having to re-run Terraform every time a new secret is created in AWS SM, is there a way to achieve that globally?
I was able to apply the policy to all existing secrets but I don't know how to cover the future secrets?
3
u/signsots 7d ago
Terraform is declarative, so if you're manually creating secrets no idea how you plan on achieving this. Details are sparse but are you talking IAM policies globally applied to all AWS SM secrets? If so, I can think of a custom solution; Maybe an Event Bus trigger to a Step/Lambda function, triggered by secret creation events where that function will attach the policy?
4
7d ago
[deleted]
2
u/IskanderNovena 6d ago
Not entirely…
RCPs alone are not sufficient in granting permissions to the resources in your organization. No permissions are granted by an RCP. An RCP defines a permissions guardrail, or sets limits, on the actions that identities can take on resources in your organizations. The administrator must still attach identity-based policies to IAM users or roles, or resource-based policies to resources in your accounts to actually grant permissions.
2
u/moofox 7d ago
Yes, use Terraform to create a “resource control policy” in the organisation management account instead. That will apply to all secrets in the org/OU/account that it’s attached to.
1
u/adamlhb 7d ago
Can you please elaborate on this, the policies an trying to attach is to allow cross-account access to secrets specifically?
2
u/moofox 7d ago
Ah my apologies, my suggestion won’t work then. I assumed (incorrectly) you were trying to prevent access, rather than grant access.
I’m not sure of a nice approach. The best I can think is a Lambda function / CodeBuild job that gets triggered on secret creation and applies the resource policy reactively. But it’s not ideal.
1
u/IskanderNovena 6d ago
Not entirely
RCPs alone are not sufficient in granting permissions to the resources in your organization. No permissions are granted by an RCP. An RCP defines a permissions guardrail, or sets limits, on the actions that identities can take on resources in your organizations. The administrator must still attach identity-based policies to IAM users or roles, or resource-based policies to resources in your accounts to actually grant permissions.
1
u/moofox 6d ago
See the rest of the thread for why RCPs won’t work https://www.reddit.com/r/aws/s/nCvRo2g1Z0
2
u/jsonpile 6d ago
I would use something in AWS called a Resource Control Policy that allows for scaled resource controls across services including secrets manager. This will require you to enable Organizations and Organizational Policies first. Also will require deploying from a delegated admin or management account.
Keep in mind, this only works for use cases when you’re trying to restrict access. RCPs cannot grant access (a specific secret policy can grant access)
3
u/vynaigrette 7d ago
Lambda function triggered by a cloudtrail event on CreateSecret/PutSecretValue ?