cloudforge v1.4.0 AWS Secrets Manager · seed 37

brief

# Lab: `secretsmanager_policy_overbroad`

b2b_saas / medium / `enterprise-vault` · prod

## Your job

Production database credentials are stored in AWS Secrets Manager. Can a principal outside this account read the secret itself?

For each path, name where it starts, what opens the way, and what the attacker reaches. That is not always data: it can be a role, a key, a secret, an image, a queue, a snapshot or a database.

## Resources

- `n00_4185/acct-main`: **Account** prod-account-4185
- `n20_4185/acct-external`: **Account** external-account-4185
- `n11_4185/sec-db-creds`: **SecretsManagerSecret** prod-db-master-credentials-4185
- `n07_4185/rds-prod-primary`: **RdsInstance** prod-postgres-primary-4185
- `n08_4185/data-prod-db-records`: **DataSet** production-database-records-4185
- `n02_4185/role-ingest-service`: **IAMRole** IngestServiceRole-4185
- `n01_4185/pol-ingest-service`: **IAMPolicy** IngestServicePolicy-4185
- `n23_4185/cicd-gitlab-ci-oidc`: **CICDIdentity** gitlab-ci-oidc-4185
- `n15_4185/role-release-audit`: **IAMRole** ReleaseAuditRole-4185
- `n06_4185/pol-release-audit-read`: **IAMPolicy** ReleaseAuditReadPolicy-4185
- `n17_4185/role-legacy-support`: **IAMRole** LegacySupportRole-4185
- `n05_4185/pol-legacy-support-read`: **IAMPolicy** LegacySupportReadPolicy-4185
- `n04_4185/role-migration-helper`: **IAMRole** MigrationHelperRole-4185
- `n14_4185/pol-migration-helper-read`: **IAMPolicy** MigrationHelperReadPolicy-4185
- `n18_4185/s3-static-site`: **S3Bucket** static-site-assets-4185
- `n13_4185/s3-open-data`: **S3Bucket** open-data-exports-4185
- `n24_4185/s3-open-data`: **S3Bucket** open-data-exports-2-4185
- `n22_4185/s3-ml-features`: **S3Bucket** ml-feature-store-4185
- `n10_4185/trail-ml-features`: **LogTrail** trail-ml-features-4185
- `n19_4185/data-ml-features`: **DataSet** feature-vectors-4185
- `n16_4185/s3-audit-evidence`: **S3Bucket** audit-evidence-4185
- `n21_4185/trail-audit-evidence`: **LogTrail** trail-audit-evidence-4185
- `n09_4185/data-audit-evidence`: **DataSet** audit-evidence-files-4185
- `n03_4185/s3-partner-uploads`: **S3Bucket** partner-uploads-4185
- `n25_4185/trail-partner-uploads`: **LogTrail** trail-partner-uploads-4185
- `n12_4185/data-partner-uploads`: **DataSet** partner-upload-files-4185

## Relationships

- `n20_4185/acct-external` --can_read--> `n11_4185/sec-db-creds`
- `n07_4185/rds-prod-primary` --stores_sensitive_data--> `n08_4185/data-prod-db-records`
- `n02_4185/role-ingest-service` --attached_policy--> `n01_4185/pol-ingest-service`
- `n02_4185/role-ingest-service` --can_read--> `n11_4185/sec-db-creds`
- `n23_4185/cicd-gitlab-ci-oidc` --assumes--> `n02_4185/role-ingest-service`
- `n15_4185/role-release-audit` --attached_policy--> `n06_4185/pol-release-audit-read`
- `n17_4185/role-legacy-support` --attached_policy--> `n05_4185/pol-legacy-support-read`
- `n04_4185/role-migration-helper` --attached_policy--> `n14_4185/pol-migration-helper-read`
- `n22_4185/s3-ml-features` --logs_to--> `n10_4185/trail-ml-features`
- `n22_4185/s3-ml-features` --stores_sensitive_data--> `n19_4185/data-ml-features`
- `n16_4185/s3-audit-evidence` --logs_to--> `n21_4185/trail-audit-evidence`
- `n16_4185/s3-audit-evidence` --stores_sensitive_data--> `n09_4185/data-audit-evidence`
- `n03_4185/s3-partner-uploads` --logs_to--> `n25_4185/trail-partner-uploads`
- `n03_4185/s3-partner-uploads` --stores_sensitive_data--> `n12_4185/data-partner-uploads`

how this works

This estate was prebaked. A unique copy composes on the server in about 20 ms from a scenario spec: 10,000 seeds per family, 15 families. No cloud account was touched; the graph is the source of truth.

The grade is one call to TypeSafe Jev: three yes/no questions (entry, hop, sink) and one depth score (0 to 3, fewer rungs on a short path), typed probabilities back. No grade yet on this page.