Description

Ensure access to the OVHcloud Secret Manager is granted only through IAM policies that name specific users, groups, or service accounts, specific secrets, and only the actions they need, such as reading one secret.

Rationale

Secret Manager holds passwords, API keys, and certificates. Broad access lets one compromised account read every secret in the account and move laterally to other systems. Scoped policies limit each identity to the secrets it needs.

Impact

  • Limits who can read or change secrets

  • Reduces lateral movement after a compromise

  • Applications may need new, narrower policies

Default Value

By default, only the account owner and identities granted by IAM policies can access Secret Manager.

Pre-Requisites

  • Access to the OVHcloud account owner login or an IAM administrator

Test Plan

  1. Log in to the OVHcloud Control Panel at https://www.ovh.com/manager/.

  2. In the left-hand menu, select Identity, Security & Operations.

  3. Under Identity and Access Management, select Policies.

  4. Review policies whose product types include Secret Manager.

  5. Flag policies that grant all actions or cover all secrets without need.

  6. If any are found, follow the implementation steps.

Implementation Steps

  1. Log in to the OVHcloud Control Panel at https://www.ovh.com/manager/.

  2. In the left-hand menu, select Identity, Security & Operations.

  3. Under Identity and Access Management, select Policies.

  4. Edit the policy to name only the required identities, select only the specific secrets or resources, and choose only the needed actions.

  5. Save the policy and confirm the applications still work.

Backout Plan

  1. Log in to the OVHcloud Control Panel at https://www.ovh.com/manager/.

  2. In the left-hand menu, select Identity, Security & Operations.

  3. Under Identity and Access Management, select Policies.

  4. Restore the previous policy settings and save.

Reference