GetSecretValue
AWS
GetSecretValue
Event
Retrieves the plaintext value of a secret stored in AWS Secrets Manager.
Security Context
- Enumerating cloud resources helps adversaries map the environment to identify high-value targets, security controls, and potential pivot points.
- Accessing stored credentials or secrets can provide adversaries with keys to additional systems, enabling lateral movement and privilege escalation.
Log Source
CloudTrail
Sample Event
Adversarial — credential access. Draco harvests the BOWTRUCKLE production database secret (bowtruckle/prod/db) by calling GetSecretValue directly. Pre-step in a chain that ends with him connecting to the prod RDS via the public-accessibility flip he’ll do later (aws-modifydbinstance). T1552 + T1526.
{ "eventVersion": "1.09", "userIdentity": { "type": "IAMUser", "principalId": "AIDADRAC0MALF0YBADGY", "arn": "arn:aws:iam::555123456789:user/draco", "accountId": "555123456789", "accessKeyId": "AKIADRAC0MALF0YEXAMP5", "userName": "draco" }, "eventTime": "2026-04-15T21:54:46Z", "eventSource": "secretsmanager.amazonaws.com", "eventName": "GetSecretValue", "awsRegion": "us-east-1", "sourceIPAddress": "203.0.113.66", "userAgent": "aws-cli/1.18.147 Python/3.7.10 Linux/5.4.0-1045-aws botocore/1.18.6", "requestParameters": { "secretId": "arn:aws:secretsmanager:us-east-1:555123456789:secret:bowtruckle/prod/db-AbCdEf", "versionStage": "AWSCURRENT" }, "responseElements": null, "requestID": "90000000-0000-4000-8000-000101000100", "eventID": "90000000-0000-4000-8000-000101000101", "readOnly": true, "resources": [ { "accountId": "555123456789", "type": "AWS::SecretsManager::Secret", "ARN": "arn:aws:secretsmanager:us-east-1:555123456789:secret:bowtruckle/prod/db-AbCdEf" } ], "eventType": "AwsApiCall", "managementEvent": true, "recipientAccountId": "555123456789", "eventCategory": "Management", "tlsDetails": { "tlsVersion": "TLSv1.3", "cipherSuite": "TLS_AES_128_GCM_SHA256", "clientProvidedHostHeader": "secretsmanager.us-east-1.amazonaws.com" }}MITRE ATT&CK Mapping
Tactics: Credential Access Discovery
Techniques:
- T1552 — Unsecured Credentials — Adversaries may search compromised systems to find and obtain insecurely stored credentials. These credentials can be stored and/or misplaced in many locations on a system, including plaintext files (e.g. [Shell History](https://attack.mitre.org/techniques/T1552/003)), operating system or applica...
- T1526 — Cloud Service Discovery — An adversary may attempt to enumerate the cloud services running on a system after gaining access. These methods can differ from platform-as-a-service (PaaS), to infrastructure-as-a-service (IaaS), or software-as-a-service (SaaS). Many services exist throughout the various cloud providers and can...