sec(iac): scope SecretsManagerDescribe to specific actions (closes #430)

[cristim]

Summary

• Removes the SecretsManagerDescribe IAM policy block from terraform/environments/aws/ci-cd-permissions/policy_data.tf
• That block granted secretsmanager:ListSecrets on Resource = "*", letting the CI/CD role enumerate all secret names in the account
• secretsmanager:ListSecrets is already present in the SecretsManager block scoped to arn:aws:secretsmanager:*:*:secret:cudly-*, so no functionality is lost

Test plan

• terraform fmt -check passes (no format changes needed)
• terraform validate passes: Success! The configuration is valid.
• No ARM template changes needed (ARM is Azure-only; no AWS Secrets Manager policy there)
• CI policy parity check passes (single-file change, no cross-IaC parity concern)

Summary by CodeRabbit

• Bug Fixes
  • Restricted AWS Secrets Manager listing permissions to specific resources, reducing overly broad access scope.

[cristim]

@coderabbitai review

[coderabbitai]

Warning

Review limit reached

@cristim, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 14 minutes and 26 seconds. Learn how PR review limits work.

Your organization has run out of usage credits. Purchase more in the billing tab.

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 259556f8-81c5-4d2d-b327-0fa09ee651f6

📥 Commits

Reviewing files that changed from the base of the PR and between 4956d66 and 15b75a2.

📒 Files selected for processing (1)

• terraform/environments/aws/ci-cd-permissions/policy_data.tf

📝 Walkthrough

Walkthrough

The CI/CD permissions policy removes an overly permissive secrets manager statement. The standalone SecretsManagerDescribe statement that allowed listing all secrets is deleted. The secretsmanager:ListSecrets permission is retained within the scoped SecretsManager statement, now limited to cudly-* secrets only.

Changes

IAM Permission Restriction

Layer / File(s)	Summary
Restrict SecretsManager ListSecrets to cudly- resources* terraform/environments/aws/ci-cd-permissions/policy_data.tf	The standalone SecretsManagerDescribe statement granting secretsmanager:ListSecrets on all resources is removed. The permission now flows only through the existing scoped SecretsManager statement, limiting secret listing to cudly-* secrets.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

Suggested labels

priority/p2, severity/medium, effort/s

Poem

🐰 Secrets once scattered, now tidily penned,
Cudly-bound access—a tightening trend,
Permissions pruned clean, overpermissive—gone,
In scope and in shape, the right rules shine on! 🔐

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately describes the main security-focused change: scoping SecretsManagerDescribe to specific actions and referencing the related issue #430.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/430-wave7

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

✅ Actions performed

Review triggered.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[cristim]

@coderabbitai full review

[coderabbitai]

✅ Actions performed

Full review triggered.

[cristim]

@coderabbitai review

[coderabbitai]

Rate Limit Exceeded

@cristim have exceeded the limit for the number of chat messages per hour. Please wait 39 minutes and 3 seconds before sending another message.

[cristim]

@coderabbitai full review

---

Generated by Claude Code

[coderabbitai]

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Fetch PR details
gh pr view 817 --repo LeanerCloud/CUDly

echo "---DIFF---"
gh pr diff 817 --repo LeanerCloud/CUDly

echo "---FILE CONTENT---"
cat terraform/environments/aws/ci-cd-permissions/policy_data.tf 2>/dev/null || echo "File not found locally"

echo "---ALL POLICY FILES---"
fd -e tf . terraform/ 2>/dev/null | head -30

Length of output: 11627

---

🌐 Web query:

AWS IAM secretsmanager:ListSecrets resource-level permissions supported ARN

Length of output: 13380

---

---

@cristim: The security intent here is spot-on — removing secretsmanager:ListSecrets on Resource = "*" is the right call. However, there's a functional issue worth flagging before merging.

---

⚠️ secretsmanager:ListSecrets is silently non-functional in the scoped block

Per the AWS Service Authorization Reference, secretsmanager:ListSecrets has no resource types — it doesn't support resource-level permissions and must always be granted with Resource = "*". This is confirmed across multiple official AWS examples, which consistently show ListSecrets in a separate statement from resource-scoped Secrets Manager actions.

After this PR, secretsmanager:ListSecrets sits in the SecretsManager block scoped to arn:aws:secretsmanager:*:*:secret:cudly-*. At runtime, IAM will not match that statement for a ListSecrets call (there's no specific secret ARN in the request), so the permission is silently dead — exactly the same anti-pattern your own codebase already guards against with RDSDescribeEngineVersions and RDSCreateProxy, both of which have inline comments explaining why they must live in wildcard-only statements.

Two possible resolutions depending on whether ListSecrets is actually needed by Terraform:

Option A — Not needed: Remove secretsmanager:ListSecrets from the SecretsManager block too (clean up the dead entry). Terraform typically uses DescribeSecret for known-ARN lookups, so this is likely safe.

Option B — Actually needed: Keep a minimal wildcard-only statement, following the established pattern in this file:

{
  # secretsmanager:ListSecrets has no resource type per the AWS Service
  # Authorization Reference and must be granted on Resource="*". Placing
  # it in the SecretsManager block (scoped to cudly-* ARNs) makes it
  # silently non-functional. Keep it isolated here. (`#430`)
  Sid      = "SecretsManagerList"
  Effect   = "Allow"
  Action   = ["secretsmanager:ListSecrets"]
  Resource = "*"
},

The PR description's claim "no functionality is lost" holds only if Terraform never calls ListSecrets (which is plausible for resource-specific operations). Worth verifying before merging — a quick terraform plan against a real environment will surface an AccessDenied if it is needed.

---

🧠 Learnings used

Learnt from: cristim
Repo: LeanerCloud/CUDly PR: 0
File: :0-0
Timestamp: 2026-05-05T15:44:54.463Z
Learning: In the LeanerCloud/CUDly repository, when a CodeRabbit review flags something as "outside-diff" that was already implemented in an earlier commit of the same PR, it is likely a stale-snapshot artifact where the review diff was generated against a pre-fix view. The inline comment convention `(CR pass on PR #<number> Finding N)` is used by the maintainer (cristim) to mark lines that were changed in direct response to a prior CodeRabbit review pass.

✅ Action performed

Full review finished.

[cristim]

@coderabbitai full review

[coderabbitai]

✅ Action performed

Full review finished.

[cristim]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[cristim]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[cristim]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[cristim]

@coderabbitai review

[cristim]

Merge-prep: rebased onto origin/main (27fdb06), no conflicts. Non-Go PR; go vet on internal/... clean. @coderabbitai full review

[cristim]

Rebased onto main (includes #1437 tflint cache + #1438 trivy skip). No Go changes; Terraform-only change to remove SecretsManagerDescribe wildcard.

[cristim]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.