Credential Access
SSM Parameter Store secret harvest
An attacker with SSM read permissions reads every parameter in the account and extracts credentials from plaintext String values and decrypted SecureString values.
Required Permissions
Description
SSM Parameter Store holds configuration values in three types: String, StringList, and SecureString. SecureString values are encrypted with KMS and decrypted on read if the caller has access to the key.
The hackaws agent walks every parameter in the account with ssm:DescribeParameters, reads each value with ssm:GetParameter, and runs the values through a secret-detection pipeline. The pipeline flags AWS access keys, bearer tokens, database connection strings, and other credential patterns.
Even SecureString values with KMS encryption are reachable if the caller has decrypt access on the key. Default KMS keys for SSM are usually readable by any principal with ssm:GetParameter.
Impact
Harvest of every secret in Parameter Store the caller can read. SSM is a common store for third-party API tokens, database passwords, and cross-service credentials.
Detection
Alert on bulk DescribeParameters and GetParameter calls, especially from a principal with no history of parameter reads. Alert on GetParameter calls that span many parameter paths in a short window. Enable KMS CloudTrail logs and flag unusual decrypt volume.
Mitigation
Scope ssm:GetParameter and kms:Decrypt by parameter path and key ARN. Use customer-managed KMS keys with a key policy that limits decrypt to specific principals. Rotate any credential a broad set of principals has ever read.