# GCP - Secretmanager Post Exploitation

{{#include ../../../banners/hacktricks-training.md}}

## Secretmanager

For more information about Secret Manager check:

{{#ref}}
../gcp-services/gcp-secrets-manager-enum.md
{{#endref}}

### `secretmanager.versions.access`

This give you access to read the secrets from the secret manager and maybe this could help to escalate privielegs (depending on which information is sotred inside the secret):

<details>

<summary>Access secret version</summary>

```bash
# Get clear-text of version 1 of secret: "<secret name>"
gcloud secrets versions access 1 --secret="<secret_name>"
```

</details>

### `secretmanager.versions.destroy`
The `secretmanager.versions.destroy` permission allows an identity to permanently destroy (mark as irreversibly deleted) a specific version of a secret in Secret Manager, which could enable the removal of critical credentials and potentially cause denial of service or prevent the recovery of sensitive data.

```bash
gcloud secrets versions destroy <VERSION> --secret="<SECRET_NAME>" --project=<PROJECTID>
```

### `secretmanager.versions.disable`
The `secretmanager.versions.disable` permission allows an identity to disable active secret versions in Secret Manager, temporarily blocking their use by applications or services that depend on them.

```bash
gcloud secrets versions disable <VERSION> --secret="<SECRET_NAME>" --project=<PROJECTID>
```

### `secretmanager.secrets.delete`
The `secretmanager.secrets.delete` permission set allows an identity to completely delete a secret and all of its stored versions in Secret Manager.

```bash
gcloud secrets delete <SECRET_NAME> --project=<PROJECT_ID>  
```

### `secretmanager.secrets.update`
The `secretmanager.secrets.update` permission allows an identity to modify a secret’s metadata and configuration (for example, rotation settings, version policy, labels, and certain secret properties).

```bash
gcloud secrets update SECRET_NAME \
  --project=PROJECT_ID \
  --clear-labels \
  --rotation-period=DURATION 
```

{{#include ../../../banners/hacktricks-training.md}}



