Skip to content

Conversation

dboeke
Copy link
Contributor

@dboeke dboeke commented Jun 26, 2025

Summary

  • Added new policy pack to check AWS resource policies for proper conditional trust relationships
  • Currently supports AWS Secrets Manager with custom approval logic
  • Verifies resources use either organizational boundaries (aws:PrincipalOrgID) or trusted accounts only

Test plan

  • Apply the policy pack to a test folder/account
  • Verify it correctly identifies secrets with organizational boundary conditions as approved
  • Verify it correctly identifies secrets with only trusted accounts as approved
  • Verify it flags secrets with untrusted access as not approved
  • Test enforcement mode if applicable

🤖 Generated with Claude Code

…vices

This policy pack checks AWS Secrets Manager secrets to verify that resource
policies either use organizational boundaries (aws:PrincipalOrgID condition)
or limit access to explicitly trusted accounts only.

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <[email protected]>
Copy link

This PR is stale because it has been open 60 days with no activity. Remove stale label or comment or this will be closed in 30 days.

@github-actions github-actions bot added the stale label Aug 25, 2025
Copy link

This PR was closed because it has been stalled for 90 days with no activity.

@github-actions github-actions bot closed this Sep 25, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant