mirror of
https://github.com/HackTricks-wiki/hacktricks-cloud.git
synced 2025-12-28 21:53:15 -08:00
77 lines
4.5 KiB
Markdown
77 lines
4.5 KiB
Markdown
# AWS - Secrets Manager Enum
|
|
|
|
{% hint style="success" %}
|
|
Learn & practice AWS Hacking:<img src="../../../.gitbook/assets/image (1) (1) (1) (1).png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="../../../.gitbook/assets/image (1) (1) (1) (1).png" alt="" data-size="line">\
|
|
Learn & practice GCP Hacking: <img src="../../../.gitbook/assets/image (2) (1).png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="../../../.gitbook/assets/image (2) (1).png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
|
|
|
<details>
|
|
|
|
<summary>Support HackTricks</summary>
|
|
|
|
* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
|
|
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks_live)**.**
|
|
* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
|
|
|
</details>
|
|
{% endhint %}
|
|
|
|
## AWS Secrets Manager
|
|
|
|
AWS Secrets Manager is designed to **eliminate the use of hard-coded secrets in applications by replacing them with an API call**. This service serves as a **centralized repository for all your secrets**, ensuring they are managed uniformly across all applications.
|
|
|
|
The manager simplifies the **process of rotating secrets**, significantly improving the security posture of sensitive data like database credentials. Additionally, secrets like API keys can be automatically rotated with the integration of lambda functions.
|
|
|
|
The access to secrets is tightly controlled through detailed IAM identity-based policies and resource-based policies.
|
|
|
|
For granting access to secrets to a user from a different AWS account, it's necessary to:
|
|
|
|
1. Authorize the user to access the secret.
|
|
2. Grant permission to the user to decrypt the secret using KMS.
|
|
3. Modify the Key policy to allow the external user to utilize it.
|
|
|
|
**AWS Secrets Manager integrates with AWS KMS to encrypt your secrets within AWS Secrets Manager.**
|
|
|
|
### **Enumeration**
|
|
|
|
```bash
|
|
aws secretsmanager list-secrets #Get metadata of all secrets
|
|
aws secretsmanager list-secret-version-ids --secret-id <secret_name> # Get versions
|
|
aws secretsmanager describe-secret --secret-id <secret_name> # Get metadata
|
|
aws secretsmanager get-secret-value --secret-id <secret_name> # Get value
|
|
aws secretsmanager get-secret-value --secret-id <secret_name> --version-id <version-id> # Get value of a different version
|
|
aws secretsmanager get-resource-policy --secret-id --secret-id <secret_name>
|
|
```
|
|
|
|
### Privesc
|
|
|
|
{% content-ref url="../aws-privilege-escalation/aws-secrets-manager-privesc.md" %}
|
|
[aws-secrets-manager-privesc.md](../aws-privilege-escalation/aws-secrets-manager-privesc.md)
|
|
{% endcontent-ref %}
|
|
|
|
### Post Exploitation
|
|
|
|
{% content-ref url="../aws-post-exploitation/aws-secrets-manager-post-exploitation.md" %}
|
|
[aws-secrets-manager-post-exploitation.md](../aws-post-exploitation/aws-secrets-manager-post-exploitation.md)
|
|
{% endcontent-ref %}
|
|
|
|
### Persistence
|
|
|
|
{% content-ref url="../aws-persistence/aws-secrets-manager-persistence.md" %}
|
|
[aws-secrets-manager-persistence.md](../aws-persistence/aws-secrets-manager-persistence.md)
|
|
{% endcontent-ref %}
|
|
|
|
{% hint style="success" %}
|
|
Learn & practice AWS Hacking:<img src="../../../.gitbook/assets/image (1) (1) (1) (1).png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="../../../.gitbook/assets/image (1) (1) (1) (1).png" alt="" data-size="line">\
|
|
Learn & practice GCP Hacking: <img src="../../../.gitbook/assets/image (2) (1).png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="../../../.gitbook/assets/image (2) (1).png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
|
|
|
<details>
|
|
|
|
<summary>Support HackTricks</summary>
|
|
|
|
* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
|
|
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks_live)**.**
|
|
* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
|
|
|
</details>
|
|
{% endhint %}
|