Seven calls to a secret, with zero Secrets Manager permissions on paper

A permission graph is assembled from edges that policies name. IAM Access Analyzer and PMapper both report that the IAM user cannot read any secret in the account ^[3], and on the evidence those tools consume they are correct: nothing grants that user Secrets Manager access ^[2], and no statement anywhere joins SNS to Secrets Manager ^[6]. The join is an API key sitting in a message payload ^[5]. A key in a payload is data, and data is not an edge, so there is no node to traverse and the answer comes back clean.

The deny list is the part worth studying, because it is what a careful reviewer actually produces. The user's policy allows `apigateway:GET` on `Resource: "*"` and then denies it on seven specific patterns covering API keys, method bodies and integration internals ^[7]. Run those seven patterns against the 24 management paths the prover walks, and 21 stay reachable ^[14]: three blocked ^[16], which leaves 87.5 percent of the enumerated surface open ^[17]. The paths that matter are among the open ones. `/restapis` lists the API IDs, `/restapis/{id}/resources` lists the paths, `/restapis/{id}/stages` lists the stages, and with those three the attacker has the full URL ^[15]. Three calls of reconnaissance against a documented chain of seven ^[18]. The integration body, the thing the deny list did protect, was never on the route.

The result is awkward for the tooling that produced it. Stave's existing broad-subscribe control inspects the topic's resource policy ^[13], and this topic has no resource policy, which in AWS leaves the identity policy as the sole gate ^[8]. A control that reads resource policies has nothing to read. The SAT verdict came instead from three facts held together: the identity policy, the missing topic policy, and an annotation on the asset recording that the topic publishes an `api_key` ^[12], with the witness naming both the topic and the REST API the key targets ^[11].

One synthetic CloudGoat user in one lab account is not a fleet ^[1], and the modelling work here is a prover run over a writeup, not a survey of production estates ^[10]. What generalises is narrower and more useful than a new attack class: the grant that ends up exercised is the Lambda execution role ^[9], written for the function, and it becomes the effective permission set of whoever can obtain the key that fronts it. Nothing in the four service configurations is misconfigured by its own checklist ^[6]. The defect is the pairing of a subscribable channel with a payload that carries authentication material, and no per-service review has a place to record that pairing.