​Implementing Compliant Secrets with AWS Secrets Manager

AWS Secrets Manager, combined with IAM, offers a powerful framework for managing and controlling access to sensitive information. In this talk, I’ll walk through configuring secrets to meet compliance requirements for certifications like ISO 27001, SOC 2, and others.

1. Compliant Secrets
How to implement with AWS Secrets Manager

2. Who can read secret?
ISO 27001 (and SOC2, PCI-DSS, SOX) requirements overview
●Access control. Must be approved, Minimum necessary rights.
●Inventory management: label information.
●Access rights review
●Encryption
●Access logging
●Off-region backups

3. AWS Secrets Manager
●IAM access control
●Encryption rest/transit
●Rotation
●Replication

4. Policy evaluation logic

5. Policy evaluation logic

6. Who has permissions
●The explicit DENY overrides everything else and blocks the action.
●The explicit ALLOW grants the action
● Implicit deny

7. Identity or Resource policy?
Role A
Role B
Role C
Secret
GetSecretValue
GetSecretValue
GetSecretValue

8. Read, Write, Admin permissions
secretsmanager:BatchGetSecretValue
secretsmanager:ListSecrets
secretsmanager:DescribeSecret
secretsmanager:GetSecretValue
secretsmanager:GetRandomPassword
secretsmanager:ListSecretVersionIds
secretsmanager:GetResourcePolicy
secretsmanager:PutSecretValue
secretsmanager:CancelRotateSecret
secretsmanager:UpdateSecret
secretsmanager:RestoreSecret
secretsmanager:RotateSecret
secretsmanager:UpdateSecretVersionStage
Read Write

9. Rules for Admin
{
"Effect" : "Allow",
"Principal" : {
"AWS" : "arn:aws:iam::493370826424:role/admin"
},
"Action" : "*",
"Resource" : "*"
}

10. Rules for Writer
[
{
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::493370826424:role/writer "
},
"Action": [
"secretsmanager:PutSecretValue" ,
...
],
"Resource": "*"
},
{
"Effect": "Deny",
"Principal": {
"AWS": "arn:aws:iam::493370826424:role/writer "
},
"Action": [
"secretsmanager:DeleteSecret" ,
...
],
"Resource": "*"
}
]

11. Rules for Reader
[
{
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::493370826424:role/writer"
},
"Action": [
"secretsmanager:GetSecretValue",
...
],
"Resource": "*"
},
{
"Effect": "Deny",
"Principal": {
"AWS": "arn:aws:iam::493370826424:role/writer"
},
"Action": [
"secretsmanager:PutSecretValue",
...
],
"Resource": "*"
}
]

12. Rules for Others
{
"Effect": "Deny",
"Principal": {
"AWS": "*"
},
"Action": "*",
"Resource": "*",
"Condition": {
"StringNotLike": {
"aws:PrincipalArn": [
"arn:aws:iam::493370826424:role/admin" ,
"arn:aws:iam::493370826424:role/writer" ,
"arn:aws:iam::493370826424:role/reader"
]
}
}
}

13. InfraHouse: terraform-aws-secret
module "smtp_credentials" {
source = "infrahouse/secret/aws"
version = "0.6.0"
secret_description = "SMTP credentials for Postfix smarthost"
secret_name_prefix = "smtp_credentials"
environment = var.environment
secret_value = jsonencode(
{
user : aws_iam_access_key.emailer. id,
password : aws_iam_access_key.emailer. ses_smtp_password_v4
}
)
readers = [
module.jumphost.jumphost_role_arn,
module.mail_twindb_com.instance_role_arn,
]
}

https://registry.terraform.io/namespaces/infrahouse

14. Testing Terraform Module
def test_module_no_access(probe_role, secretsmanager_client):
with terraform_apply(
terraform_module_dir,
destroy_after=DESTROY_AFTER,
json_output=True,
enable_trace=TRACE_TERRAFORM,
) as tf_output:
LOG.info("%s", json.dumps(tf_output, indent=4))
sm_client = get_secretsmanager_client_by_role(probe_role[ "role_arn"]["value"])
with pytest.raises(ClientError) as err:
sm_client.get_secret_value(
SecretId="foo",
)
assert err.type is ClientError
assert err.value.response["Error"]["Code"] == "AccessDeniedException"

15. https://infrahouse.com/posts/2024-09-29-compliant-secrets/

Slides