Detection of Potential Credential Access via AWS SSM SecureString Decryption

Adversaries targeting AWS environments often seek to retrieve sensitive information, such as API keys, database passwords, and encryption keys, stored within the AWS Systems Manager (SSM) Parameter Store. SecureString parameters are encrypted at rest using AWS Key Management Service (KMS) keys. When an attacker gains initial access, they may attempt to leverage the GetParameter or GetParameters API actions with the withDecryption parameter set to true to obtain plaintext credentials.

This detection logic monitors AWS CloudTrail management events to identify the first time an AWS identity requests the decryption of these sensitive parameters. By focusing on new occurrences of this behavior for specific identities, security teams can identify anomalous credential discovery attempts that deviate from established operational baselines. Monitoring these events is critical, as successful retrieval of these secrets often facilitates subsequent privilege escalation and lateral movement within the cloud infrastructure.

Impact

Successful exploitation of this technique allows an attacker to bypass encryption controls and obtain plaintext credentials stored in AWS Parameter Store. This can lead to full compromise of downstream services, data exfiltration, or unauthorized persistence within the environment, depending on the scope of the accessed secrets.

Recommendation

• Ensure AWS CloudTrail is configured to collect data events for AWS SSM API actions to provide the necessary visibility for this detection.
• Deploy the provided detection logic to identify the first-time access of SecureString parameters with decryption enabled, and investigate alerts for unauthorized identities.
• Review IAM policies and apply the principle of least privilege to restrict access to the ssm:GetParameter and ssm:GetParameters actions, specifically where withDecryption is required.
• Audit IAM roles and users that have permissions to both SSM Parameter Store and the associated KMS keys used for encryption.