- You can achieve least-privilege access to AWS Secrets Manager by attaching a resource-based policy to the secret, even when you cannot modify the identity policy (e.g., in Academy Labs or cross-account setups).
- The dual-layer access model evaluates both identity-based and resource-based policies; a restrictive resource policy can constrain an overly broad identity policy.
- The implementation uses Terraform to create the secret with a recovery window of zero for lab environments, dynamically resolve the LabRole ARN, and attach a resource policy with conditions like `VersionStage=AWSCURRENT`.
- Block public policy (`block_public_policy = true`) prevents accidental public access via automated reasoning checks.
- Testing includes a positive test reading from an EC2 instance with LabInstanceProfile and a negative test requesting AWSPREVIOUS to validate the policy condition.
- Security considerations include using `secret_string_wo` (Terraform >=1.11) for write-only attributes, not relying solely on `sensitive = true`, and aligning with CIS controls for encryption and public access.
- The pattern is not limited to Academy Labs; it applies whenever you cannot edit an identity policy, such as cross-account roles or SCP-locked environments.