Detection of Unauthorized AWS Secrets Manager Credential Retrieval

Adversaries with initial access to AWS environments often target AWS Secrets Manager to escalate privileges or move laterally. By compromising service-linked identities - such as those assigned to EC2 instances or Lambda functions - attackers can invoke the GetSecretValue API to extract credentials that were intended to replace hardcoded secrets. This behavior represents a significant risk, as legitimate service roles may possess broad permissions to access multiple secrets. Defenders should monitor for anomalous or first-time programmatic access to secret values by specific user identities. Monitoring CloudTrail logs for the GetSecretValue action, while filtering out known service role activity, provides visibility into potential credential harvesting attempts. Because this activity is often performed programmatically, inspecting user agent strings and source IP addresses against historical baselines is essential for identifying unauthorized access.

Attack Chain

1. Attacker gains initial access to a cloud-resident asset such as an EC2 instance or Lambda function.
2. Attacker enumerates available IAM permissions to identify access to AWS Secrets Manager.
3. Attacker discovers target secret identifiers via service enumeration or local configuration file analysis.
4. Attacker executes the GetSecretValue API call using the compromised instance's IAM role credentials.
5. Attacker retrieves the cleartext secret value or sensitive configuration data returned by the API.
6. Attacker utilizes the harvested credentials to access additional internal services or databases.
7. Attacker maintains persistence or performs further data exfiltration using the compromised credentials.

Impact

Successful exploitation allows attackers to gain unauthorized access to databases, third-party services, and other high-value infrastructure. The impact includes potential data exfiltration, unauthorized administrative access, and lateral movement across the cloud environment. By harvesting these secrets, an attacker can effectively bypass network-level controls and maintain access even if the initial entry point is secured.

Recommendation

• Deploy the provided Sigma-compatible detection logic to monitor CloudTrail for unusual GetSecretValue events.
• Audit IAM policies associated with EC2 and Lambda service roles to ensure the principle of least privilege is strictly applied to Secrets Manager access.
• Establish baselines for service-to-secret mapping to reduce the noise of legitimate programmatic access.
• Review CloudTrail logs for anomalous user agents (e.g., non-SDK, manual CLI usage) associated with GetSecretValue actions.
• Enable multi-factor authentication for all IAM users and limit the scope of long-lived access keys where possible.