mirror of
https://github.com/HackTricks-wiki/hacktricks-cloud.git
synced 2025-12-23 15:37:53 -08:00
80 lines
4.1 KiB
Markdown
80 lines
4.1 KiB
Markdown
# AWS - Secrets Manager Persistence
|
|
|
|
{% hint style="success" %}
|
|
Learn & practice AWS Hacking:<img src="../../../.gitbook/assets/image (1) (1) (1) (1).png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="../../../.gitbook/assets/image (1) (1) (1) (1).png" alt="" data-size="line">\
|
|
Learn & practice GCP Hacking: <img src="../../../.gitbook/assets/image (2) (1).png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="../../../.gitbook/assets/image (2) (1).png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
|
|
|
<details>
|
|
|
|
<summary>Support HackTricks</summary>
|
|
|
|
* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
|
|
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks_live)**.**
|
|
* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
|
|
|
</details>
|
|
{% endhint %}
|
|
|
|
## Secrets Manager
|
|
|
|
For more info check:
|
|
|
|
{% content-ref url="../aws-services/aws-secrets-manager-enum.md" %}
|
|
[aws-secrets-manager-enum.md](../aws-services/aws-secrets-manager-enum.md)
|
|
{% endcontent-ref %}
|
|
|
|
### Via Resource Policies
|
|
|
|
It's possible to **grant access to secrets to external accounts** via resource policies. Check the [**Secrets Manager Privesc page**](../aws-privilege-escalation/aws-secrets-manager-privesc.md) for more information. Note that to **access a secret**, the external account will also **need access to the KMS key encrypting the secret**.
|
|
|
|
### Via Secrets Rotate Lambda
|
|
|
|
To **rotate secrets** automatically a configured **Lambda** is called. If an attacker could **change** the **code** he could directly **exfiltrate the new secret** to himself.
|
|
|
|
This is how lambda code for such action could look like:
|
|
|
|
```python
|
|
import boto3
|
|
|
|
def rotate_secrets(event, context):
|
|
# Create a Secrets Manager client
|
|
client = boto3.client('secretsmanager')
|
|
|
|
# Retrieve the current secret value
|
|
secret_value = client.get_secret_value(SecretId='example_secret_id')['SecretString']
|
|
|
|
# Rotate the secret by updating its value
|
|
new_secret_value = rotate_secret(secret_value)
|
|
client.update_secret(SecretId='example_secret_id', SecretString=new_secret_value)
|
|
|
|
def rotate_secret(secret_value):
|
|
# Perform the rotation logic here, e.g., generate a new password
|
|
|
|
# Example: Generate a new password
|
|
new_secret_value = generate_password()
|
|
|
|
return new_secret_value
|
|
|
|
def generate_password():
|
|
# Example: Generate a random password using the secrets module
|
|
import secrets
|
|
import string
|
|
password = ''.join(secrets.choice(string.ascii_letters + string.digits) for i in range(16))
|
|
return password
|
|
```
|
|
|
|
{% hint style="success" %}
|
|
Learn & practice AWS Hacking:<img src="../../../.gitbook/assets/image (1) (1) (1) (1).png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="../../../.gitbook/assets/image (1) (1) (1) (1).png" alt="" data-size="line">\
|
|
Learn & practice GCP Hacking: <img src="../../../.gitbook/assets/image (2) (1).png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="../../../.gitbook/assets/image (2) (1).png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
|
|
|
<details>
|
|
|
|
<summary>Support HackTricks</summary>
|
|
|
|
* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
|
|
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks_live)**.**
|
|
* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
|
|
|
</details>
|
|
{% endhint %}
|