brief

# Lab: `secretsmanager_policy_overbroad`

b2b_saas / medium / `enterprise-vault` · prod

## Your job

Production database credentials are stored in AWS Secrets Manager. Can a principal outside this account read the secret itself?

For each path, name where it starts, what opens the way, and what the attacker reaches. That is not always data: it can be a role, a key, a secret, an image, a queue, a snapshot or a database.

## Resources

- `n32_9510/acct-main`: **Account** prod-account-9510
- `n20_9510/acct-external`: **Account** external-account-9510
- `n38_9510/sec-db-creds`: **SecretsManagerSecret** prod-db-master-credentials-9510
- `n04_9510/rds-prod-primary`: **RdsInstance** prod-postgres-primary-9510
- `n16_9510/data-prod-db-records`: **DataSet** production-database-records-9510
- `n19_9510/role-ingest-service`: **IAMRole** IngestServiceRole-9510
- `n27_9510/pol-ingest-service`: **IAMPolicy** IngestServicePolicy-9510
- `n35_9510/role-legacy-support`: **IAMRole** LegacySupportRole-9510
- `n21_9510/pol-legacy-support-read`: **IAMPolicy** LegacySupportReadPolicy-9510
- `n22_9510/role-migration-helper`: **IAMRole** MigrationHelperRole-9510
- `n07_9510/pol-migration-helper-read`: **IAMPolicy** MigrationHelperReadPolicy-9510
- `n40_9510/role-migration-helper`: **IAMRole** MigrationHelperRole-2-9510
- `n30_9510/pol-migration-helper-read`: **IAMPolicy** MigrationHelperReadPolicy-2-9510
- `n14_9510/s3-marketing-downloads`: **S3Bucket** marketing-downloads-9510
- `n03_9510/s3-marketing-downloads`: **S3Bucket** marketing-downloads-2-9510
- `n25_9510/s3-ops-runbooks`: **S3Bucket** ops-runbooks-9510
- `n08_9510/trail-ops-runbooks`: **LogTrail** trail-ops-runbooks-9510
- `n06_9510/data-ops-runbooks`: **DataSet** runbook-library-9510
- `n33_9510/kms-app-configs`: **KmsKey** kms-app-configs-9510
- `n36_9510/role-prometheus-agent`: **IAMRole** PrometheusAgentRole-9510
- `n05_9510/role-backup-runner`: **IAMRole** BackupRunnerRole-9510
- `n37_9510/s3-exports-staging`: **S3Bucket** exports-staging-9510
- `n18_9510/s3-build-artifacts`: **S3Bucket** build-artifacts-9510
- `n26_9510/s3-media-cache`: **S3Bucket** media-cache-9510
- `n15_9510/trail-audit-operations`: **LogTrail** trail-audit-operations-9510
- `n28_9510/role-cloud-watch-agent`: **IAMRole** CloudWatchAgentRole-9510
- `n13_9510/data-reporting-store`: **DataSet** data-reporting-store-9510
- `n24_9510/sqs-jobs-dispatch`: **SqsQueue** jobs-dispatch-9510
- `n02_9510/trail-audit-operations`: **LogTrail** trail-audit-operations-2-9510
- `n10_9510/kms-app-configs`: **KmsKey** kms-app-configs-2-9510
- `n17_9510/s3-assets-archive`: **S3Bucket** assets-archive-9510
- `n31_9510/role-datadog-monitoring`: **IAMRole** DatadogMonitoringRole-9510
- `n01_9510/kms-internal-telemetry`: **KmsKey** kms-internal-telemetry-9510
- `n29_9510/ecr-utility-image`: **EcrRepository** repo-utility-image-9510
- `n11_9510/ecr-base-runner`: **EcrRepository** repo-base-runner-9510
- `n23_9510/role-datadog-monitoring`: **IAMRole** DatadogMonitoringRole-2-9510
- `n39_9510/trail-infra-events`: **LogTrail** trail-infra-events-9510
- `n09_9510/data-operational-metrics`: **DataSet** data-operational-metrics-9510
- `n12_9510/sqs-notifications-stream`: **SqsQueue** notifications-stream-9510
- `n34_9510/role-cloud-watch-agent`: **IAMRole** CloudWatchAgentRole-2-9510
- `n00_9510/sqs-ingest-pipeline`: **SqsQueue** ingest-pipeline-9510

## Relationships

- `n20_9510/acct-external` --can_read--> `n38_9510/sec-db-creds`
- `n04_9510/rds-prod-primary` --stores_sensitive_data--> `n16_9510/data-prod-db-records`
- `n19_9510/role-ingest-service` --attached_policy--> `n27_9510/pol-ingest-service`
- `n19_9510/role-ingest-service` --can_read--> `n38_9510/sec-db-creds`
- `n35_9510/role-legacy-support` --attached_policy--> `n21_9510/pol-legacy-support-read`
- `n22_9510/role-migration-helper` --attached_policy--> `n07_9510/pol-migration-helper-read`
- `n40_9510/role-migration-helper` --attached_policy--> `n30_9510/pol-migration-helper-read`
- `n25_9510/s3-ops-runbooks` --logs_to--> `n08_9510/trail-ops-runbooks`
- `n25_9510/s3-ops-runbooks` --stores_sensitive_data--> `n06_9510/data-ops-runbooks`

how this works

This estate was prebaked. A unique copy composes on the server in about 20 ms from a scenario spec: 10,000 seeds per family, 15 families. No cloud account was touched; the graph is the source of truth.

The grade is one call to TypeSafe Jev: three yes/no questions (entry, hop, sink) and one depth score (0 to 3, fewer rungs on a short path), typed probabilities back. No grade yet on this page.

cloudforge on GitHub