Credential Access
Secrets Manager harvest
An attacker with Secrets Manager read permissions pulls every secret in the account.
Required Permissions
Description
Secrets Manager is the AWS-native store for credentials. Secrets are encrypted with KMS and returned in plaintext to any caller with secretsmanager:GetSecretValue and decrypt access on the key.
The hackaws agent lists every secret in the account with secretsmanager:ListSecrets and reads each value with secretsmanager:GetSecretValue. The returned values are run through a secret-detection pipeline, which treats structured secrets (JSON with username and password fields, RDS credential documents) separately from freeform strings.
Secrets Manager is designed to hold the most sensitive credentials. A harvest here is often the shortest path from read-only access to another system entirely: databases, third-party SaaS, cross-account roles.
Impact
Every secret the caller can read is now in the attacker's hands. Database passwords, API tokens for external services, and cross-account credentials are all common Secrets Manager contents.
Detection
Alert on bulk ListSecrets or GetSecretValue calls. Baseline normal secret-read volume per principal and flag spikes. Alert on GetSecretValue calls from principals that have never read that secret before.
Mitigation
Scope secretsmanager:GetSecretValue by secret ARN. Use resource policies on secrets to restrict callers. Use customer-managed KMS keys with a tight key policy. Rotate any secret ever read by a principal that should not have had access.