# Ensure Secret Manager Secret is Not Publicly Accessible

- Source: https://support.icompaas.com/support/solutions/articles/a_1788888308125546-ensure-secret-manager-secret-is-not-publicly-accessible
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [GCP Benchmarks](https://support.icompaas.com/support/solutions/62000112667) › [GCP Knowledge Bases](https://support.icompaas.com/support/solutions/folders/62000169178)
- Last updated: 2026-09-08
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure that Secret Manager secrets do not grant the allUsers or allAuthenticatedUsers principal any IAM role (such as Secret Manager Secret Accessor) that would allow the secret's contents to be read publicly or by any authenticated Google account.

**Rationale**

Secret Manager is intended to store sensitive values such as API keys, passwords, and tokens; granting access to allUsers or allAuthenticatedUsers effectively removes the confidentiality protection Secret Manager is designed to provide, exposing the secret's value to the public internet or to any Google account holder. Access to secrets should always be scoped to the specific service accounts, users, or groups that legitimately require it.

**Impact**

-   Prevents public or broad-internet exposure of sensitive values stored in Secret Manager
    
-   Ensures access to secrets follows least-privilege principles
    
-   Reduces the risk of credential theft resulting from an overly permissive secret IAM policy
    

**Default Value**

By default, newly created Secret Manager secrets are not accessible to allUsers or allAuthenticatedUsers; access must be explicitly granted.

**Pre-Requisites**

-   IAM permissions to view and edit IAM policies on Secret Manager secrets (e.g., Secret Manager Admin)
    

**Test Plan**

1.  Sign in to the Google Cloud Console at [https://console.cloud.google.com](https://console.cloud.google.com/).
    
2.  Select the relevant project.
    
3.  Navigate to Security > Secret Manager.
    
4.  Select the secret to review, then open the Permissions tab.
    
5.  Review the list of principals granted access to the secret.
    
6.  Verify that allUsers and allAuthenticatedUsers do not appear with any role, particularly Secret Manager Secret Accessor.
    
7.  If either principal is present, follow the implementation steps.
    

**Implementation Steps**

1.  Sign in to the Google Cloud Console at [https://console.cloud.google.com](https://console.cloud.google.com/).
    
2.  Select the relevant project.
    
3.  Navigate to Security > Secret Manager and select the affected secret.
    
4.  Open the Permissions tab.
    
5.  Locate the allUsers or allAuthenticatedUsers entry and select Remove access.
    
6.  Confirm the removal.
    
7.  Grant the Secret Manager Secret Accessor role only to the specific service accounts or users that legitimately need to read the secret's value.
    

**Backout Plan**

1.  Sign in to the Google Cloud Console at [https://console.cloud.google.com](https://console.cloud.google.com/).
    
2.  Select the relevant project.
    
3.  Navigate to Security > Secret Manager and select the affected secret.
    
4.  Open the Permissions tab and select Add principal.
    
5.  Add allUsers or allAuthenticatedUsers back with the Secret Manager Secret Accessor role.
    
6.  Save the change.
    

**Reference**

-   [https://cloud.google.com/secret-manager/docs/access-control](https://cloud.google.com/secret-manager/docs/access-control)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.