# Secrets Manager and SSM Parameter Store Enumeration

> Techniques for enumerating AWS Secrets Manager and SSM Parameter Store to discover stored credentials, API keys, and sensitive configuration data during cloud assessments.

- **URL:** https://hackindex.io/platforms/aws/enumeration/secrets/secrets-manager-and-ssm-parameter-store-enumeration
- **Path:** AWS > Enumeration > Secrets
- **Up:** [Secrets](https://hackindex.io/platforms/aws/enumeration/secrets.md)
- **Published:** 2026-05-24
- **Updated:** 2026-05-24

Secrets Manager and SSM Parameter Store are the intended places to store secrets in AWS. Gaining `secretsmanager:GetSecretValue` or `ssm:GetParameter` with the right resource scope dumps credentials directly.

- Secrets Manager entries with names matching `*password*`, `*db*`, `*api*`, or `*token*`
- SSM parameters of type `SecureString` (encrypted with KMS, decryptable if you have `kms:Decrypt`)
- Plaintext `String` parameters that should have been `SecureString`
- Resource policies on secrets allowing cross-account or overly broad access

## Secrets Manager

List all secrets (names and metadata only):

```bash
aws secretsmanager list-secrets --profile $PROFILE --region $REGION --query 'SecretList[*].{Name:Name,ARN:ARN,Description:Description,Modified:LastChangedDate}' --output table
```

Retrieve the value of a specific secret:

```bash
aws secretsmanager get-secret-value --secret-id $SECRET_NAME --profile $PROFILE --region $REGION
# {
#     "Name": "prod/myapp/db",
#     "SecretString": "{\"username\":\"admin\",\"password\":\"Sup3rS3cret!\",\"host\":\"mydb.cluster.us-east-1.rds.amazonaws.com\"}"
# }
```

Dump all secret values at once:

**Dump all secrets**

```bash
aws secretsmanager list-secrets --profile $PROFILE --region $REGION --query 'SecretList[*].Name' --output text | tr '\t' '\n' | while read secret; do
  echo "=== $secret ==="
  aws secretsmanager get-secret-value --secret-id "$secret" --profile $PROFILE --region $REGION 2>/dev/null | jq -r '.SecretString // .SecretBinary'
done
```

## SSM Parameter Store

List all parameters:

```bash
aws ssm describe-parameters --profile $PROFILE --region $REGION --query 'Parameters[*].{Name:Name,Type:Type,Modified:LastModifiedDate}' --output table
```

`SecureString` parameters are encrypted with KMS. `String` and `StringList` are plaintext.

Retrieve a specific parameter (`SecureString` is automatically decrypted with `--with-decryption`):

```bash
aws ssm get-parameter --name $PARAM_NAME --with-decryption --profile $PROFILE --region $REGION | jq -r '.Parameter.Value'
```

**Retrieve all parameters by path**

```bash
aws ssm get-parameters-by-path --path "/" --recursive --with-decryption --profile $PROFILE --region $REGION --query 'Parameters[*].{Name:Name,Value:Value}' --output table
```

> [!WARNING]
> `get-parameters-by-path` on `/` returns everything in the account. In large environments this may be thousands of parameters. Narrow the path if possible: `/prod/`, `/app/myapp/`, etc.

## Common Secret Naming Patterns

After listing, prioritise secrets matching:

```
*password*
*secret*
*key*
*token*
*credential*
*db*
*rds*
*database*
*api*
*access*
*slack*
*github*
```

```bash
aws secretsmanager list-secrets --profile $PROFILE --region $REGION | jq -r '.SecretList[].Name' | grep -iE "password|secret|key|token|db|api|credential"
```

## KMS Key Check

SecureString parameters and Secrets Manager values use KMS for encryption. If you have `kms:Decrypt` on the relevant key, `--with-decryption` works automatically. If not, you see:

```
An error occurred (AccessDeniedException): ... is not authorized to perform: kms:Decrypt
```

**Check KMS keys**

```bash
aws kms list-keys --profile $PROFILE --region $REGION
aws kms describe-key --key-id $KEY_ID --profile $PROFILE --region $REGION
```