SecretScope
A Terraform policy linter that flags overly broad secretsmanager:* identity policies and auto-generates a least-privilege aws_secretsmanager_secret_policy resource block attached to the specific secret — exactly the compensating-control pattern the HN post describes for environments where you can't touch IAM.
Cloud security and platform engineers writing Terraform in locked-down AWS accounts (Academy labs, vendor-managed landing zones, SCP-restricted orgs)
- tflint/tfsec rule that detects secretsmanager:* wildcards on identity policies and explains why
- Auto-generated aws_secretsmanager_secret_policy with principal, action and condition scoping
- Dry-run deploy that simulates Allow vs Deny decisions against a sample role ARN
- Positive/negative test harness (the exact pattern the article uses) baked in
The HN article documents a workaround most engineers don't know exists; demand is rising as more teams land in SCP-locked or vendor-managed accounts they can't reshape.
Source HN post drew only 18 points and 0 comments — niche awareness, not viral; a Stack Overflow question on the exact resource-policy pattern exists, showing practitioners do hit the problem but audience is small.AWS Secrets Manager Terraform: Least-Privilege Access ↗How to create secrets manager secret resource policy that references the secret ↗
General-purpose IaC scanners (tflint, tfsec/Trivy, checkov) dominate the Terraform-linter category and could add a rule for this, but none appear to ship the auto-generate-compensating-resource workflow; closest neighbor (terraform-policymaker) targets deploy-role policies, not secret resource policies.GitHub - terraform-linters/tflint: A Pluggable Terraform Linter ↗GitHub - aquasecurity/tfsec: Tfsec is now part of Trivy ↗GitHub - scottwinkler/terraform-policymaker: Tool for generating least privilege policy for terraform deployments ↗
Developers expect free Terraform linters (tflint/tfsec/checkov are open source); a single-rule CLI is too narrow for an enterprise SaaS seat, and the target users (academy/lab and SCP-locked accounts) are the most price-sensitive segments.Secure, Lint, and Validate Your Terraform Like a Pro ↗Terraform Security Scanning in CI: Using tfsec and Checkov with GitHub Actions ↗
SCPs, vendor-managed landing zones, and Academy-style locked accounts are a structural and growing AWS pattern; the aws_secretsmanager_secret_policy resource is a stable, documented Terraform Registry API, so the underlying need should persist for years.Resource: aws_secretsmanager_secret_policy - Terraform Registry ↗
Scope is well-bounded: parse HCL, regex/AST-match broad secretsmanager:* identity statements, and emit a valid aws_secretsmanager_secret_policy block; HCL parsers and reference modules already exist to reuse.Resource: aws_secretsmanager_secret_policy - Terraform Registry ↗GitHub - terraform-aws-modules/terraform-aws-secrets-manager ↗