Description

Ensure that Secret Manager secrets do not grant the allUsers or allAuthenticatedUsers principal any IAM role (such as Secret Manager Secret Accessor) that would allow the secret's contents to be read publicly or by any authenticated Google account.

Rationale

Secret Manager is intended to store sensitive values such as API keys, passwords, and tokens; granting access to allUsers or allAuthenticatedUsers effectively removes the confidentiality protection Secret Manager is designed to provide, exposing the secret's value to the public internet or to any Google account holder. Access to secrets should always be scoped to the specific service accounts, users, or groups that legitimately require it.

Impact

  • Prevents public or broad-internet exposure of sensitive values stored in Secret Manager

  • Ensures access to secrets follows least-privilege principles

  • Reduces the risk of credential theft resulting from an overly permissive secret IAM policy

Default Value

By default, newly created Secret Manager secrets are not accessible to allUsers or allAuthenticatedUsers; access must be explicitly granted.

Pre-Requisites

  • IAM permissions to view and edit IAM policies on Secret Manager secrets (e.g., Secret Manager Admin)

Test Plan

  1. Sign in to the Google Cloud Console at https://console.cloud.google.com.

  2. Select the relevant project.

  3. Navigate to Security > Secret Manager.

  4. Select the secret to review, then open the Permissions tab.

  5. Review the list of principals granted access to the secret.

  6. Verify that allUsers and allAuthenticatedUsers do not appear with any role, particularly Secret Manager Secret Accessor.

  7. If either principal is present, follow the implementation steps.

Implementation Steps

  1. Sign in to the Google Cloud Console at https://console.cloud.google.com.

  2. Select the relevant project.

  3. Navigate to Security > Secret Manager and select the affected secret.

  4. Open the Permissions tab.

  5. Locate the allUsers or allAuthenticatedUsers entry and select Remove access.

  6. Confirm the removal.

  7. Grant the Secret Manager Secret Accessor role only to the specific service accounts or users that legitimately need to read the secret's value.

Backout Plan

  1. Sign in to the Google Cloud Console at https://console.cloud.google.com.

  2. Select the relevant project.

  3. Navigate to Security > Secret Manager and select the affected secret.

  4. Open the Permissions tab and select Add principal.

  5. Add allUsers or allAuthenticatedUsers back with the Secret Manager Secret Accessor role.

  6. Save the change.

Reference