# Lab: `secretsmanager_policy_overbroad` b2b_saas / medium / `enterprise-vault` · prod ## Your job Production database credentials are stored in AWS Secrets Manager. Can a principal outside this account read the secret itself? For each path, name where it starts, what opens the way, and what the attacker reaches. That is not always data: it can be a role, a key, a secret, an image, a queue, a snapshot or a database. ## Resources - `n00_4185/acct-main`: **Account** prod-account-4185 - `n20_4185/acct-external`: **Account** external-account-4185 - `n11_4185/sec-db-creds`: **SecretsManagerSecret** prod-db-master-credentials-4185 - `n07_4185/rds-prod-primary`: **RdsInstance** prod-postgres-primary-4185 - `n08_4185/data-prod-db-records`: **DataSet** production-database-records-4185 - `n02_4185/role-ingest-service`: **IAMRole** IngestServiceRole-4185 - `n01_4185/pol-ingest-service`: **IAMPolicy** IngestServicePolicy-4185 - `n23_4185/cicd-gitlab-ci-oidc`: **CICDIdentity** gitlab-ci-oidc-4185 - `n15_4185/role-release-audit`: **IAMRole** ReleaseAuditRole-4185 - `n06_4185/pol-release-audit-read`: **IAMPolicy** ReleaseAuditReadPolicy-4185 - `n17_4185/role-legacy-support`: **IAMRole** LegacySupportRole-4185 - `n05_4185/pol-legacy-support-read`: **IAMPolicy** LegacySupportReadPolicy-4185 - `n04_4185/role-migration-helper`: **IAMRole** MigrationHelperRole-4185 - `n14_4185/pol-migration-helper-read`: **IAMPolicy** MigrationHelperReadPolicy-4185 - `n18_4185/s3-static-site`: **S3Bucket** static-site-assets-4185 - `n13_4185/s3-open-data`: **S3Bucket** open-data-exports-4185 - `n24_4185/s3-open-data`: **S3Bucket** open-data-exports-2-4185 - `n22_4185/s3-ml-features`: **S3Bucket** ml-feature-store-4185 - `n10_4185/trail-ml-features`: **LogTrail** trail-ml-features-4185 - `n19_4185/data-ml-features`: **DataSet** feature-vectors-4185 - `n16_4185/s3-audit-evidence`: **S3Bucket** audit-evidence-4185 - `n21_4185/trail-audit-evidence`: **LogTrail** trail-audit-evidence-4185 - `n09_4185/data-audit-evidence`: **DataSet** audit-evidence-files-4185 - `n03_4185/s3-partner-uploads`: **S3Bucket** partner-uploads-4185 - `n25_4185/trail-partner-uploads`: **LogTrail** trail-partner-uploads-4185 - `n12_4185/data-partner-uploads`: **DataSet** partner-upload-files-4185 ## Relationships - `n20_4185/acct-external` --can_read--> `n11_4185/sec-db-creds` - `n07_4185/rds-prod-primary` --stores_sensitive_data--> `n08_4185/data-prod-db-records` - `n02_4185/role-ingest-service` --attached_policy--> `n01_4185/pol-ingest-service` - `n02_4185/role-ingest-service` --can_read--> `n11_4185/sec-db-creds` - `n23_4185/cicd-gitlab-ci-oidc` --assumes--> `n02_4185/role-ingest-service` - `n15_4185/role-release-audit` --attached_policy--> `n06_4185/pol-release-audit-read` - `n17_4185/role-legacy-support` --attached_policy--> `n05_4185/pol-legacy-support-read` - `n04_4185/role-migration-helper` --attached_policy--> `n14_4185/pol-migration-helper-read` - `n22_4185/s3-ml-features` --logs_to--> `n10_4185/trail-ml-features` - `n22_4185/s3-ml-features` --stores_sensitive_data--> `n19_4185/data-ml-features` - `n16_4185/s3-audit-evidence` --logs_to--> `n21_4185/trail-audit-evidence` - `n16_4185/s3-audit-evidence` --stores_sensitive_data--> `n09_4185/data-audit-evidence` - `n03_4185/s3-partner-uploads` --logs_to--> `n25_4185/trail-partner-uploads` - `n03_4185/s3-partner-uploads` --stores_sensitive_data--> `n12_4185/data-partner-uploads`
This estate was prebaked. A unique copy composes on the server in about 20 ms from a scenario spec: 10,000 seeds per family, 15 families. No cloud account was touched; the graph is the source of truth.
The grade is one call to TypeSafe Jev: three yes/no questions (entry, hop, sink) and one depth score (0 to 3, fewer rungs on a short path), typed probabilities back. No grade yet on this page.
cloudforge on GitHub