Description

Identifies AWS CloudFormation templates that contain AWS Secrets Manager secrets with weak secret string generation configurations. This could lead to predictable or insufficiently random secret values being generated, potentially compromising the security of systems that rely on these secrets.

Detection Strategy

• Scan CloudFormation template files for AWS::SecretsManager::Secret resource definitions

• Check if the GenerateSecretString property in the secret resource has insecure configuration settings

• Report a vulnerability if password generation parameters are missing or configured with weak settings (such as insufficient length or character requirements)

Vulnerable code example

Resources:
  MySecret1:
    Type: AWS::SecretsManager::Secret
    Properties:
      Name: MySecretForAppA
      Description: Secret with weak password policy
      GenerateSecretString:
        SecretStringTemplate: '{"username":"admin"}'...

✅ Secure code example

Resources:
  MySecret1:
    Type: AWS::SecretsManager::Secret
    Properties:
      Name: MySecretForAppA
      Description: Secret with strong password policy
      GenerateSecretString:
        SecretStringTemplate: '{"username":"admin"}'...