secretmanager.secrets.delete
secretmanager.secrets.delete
Event
DeleteSecret irreversibly deletes the secret resource and its versions from Secret Manager. Delayed destruction of individual versions is a separate feature and should not be treated as recovery protection for deletion of the whole secret.
Security Context
Unauthorized deletion can cause destructive impact (T1485). Applications that subsequently fetch the deleted secret receive Not Found; cached values and independent copies can remain. Deletion neither rotates the credential in its target system nor erases prior audit records.
Log Source
Cloud Audit Logs: secretmanager.googleapis.com, method google.cloud.secretmanager.v1.SecretManagerService.DeleteSecret. Admin Activity. Inspect status and resulting state; a granted permission alone does not establish success.
Key Fields
| Field | Investigation value |
|---|---|
protoPayload.authenticationInfo, requestMetadata | Effective caller, delegation where present, and request context. |
protoPayload.methodName, resourceName | Operation and exact target; distinguish versions/generations and resource scope. |
protoPayload.authorizationInfo, status | Available permission checks and outcome; inspect errors. |
protoPayload.request, response, serviceData | Settings, returned state, or policy deltas where present; compare old state separately. |
timestamp, logName | Timing, owning resource, and audit stream. |
What to Investigate
- Confirm the observed change and compare it with the approved workflow.
- Confirm the exact secret, optional etag, actor, approval, and operation outcome.
- Identify clients that fetch the secret and inspect observed failures, cached values, and separately retained recovery material.
- Correlate prior accesses and later credential rotation independently; do not infer theft or an outage from the secret’s name.
Sample Event
Synthetic scenario. The example deletes bowtruckle-prod-db-master-pass. It does not establish its actual contents, dependent database, prior exfiltration, or application outage.
Exact optional fields, payload disclosure, and protobuf serialization remain unverified against captured logs. These synthetic examples do not establish an attack chain and are not parser fixtures.
{ "protoPayload": { "@type": "type.googleapis.com/google.cloud.audit.AuditLog", "authenticationInfo": { "principalEmail": "draco@fantasticlogs.cloud" }, "requestMetadata": { "callerIp": "203.0.113.66", "callerSuppliedUserAgent": "google-cloud-sdk gcloud/465.0.0 command/gcloud.secrets.delete invocation-id/90000000000000000000010000000001 environment/None environment-version/None client-os/LINUX client-os-ver/(5,15,0) client-pltf-arch/x86_64 interactive/False from-script/False python/3.11.6 term/xterm-256color (Linux 5.15.0-1052-aws),gzip(gfe)", "requestAttributes": { "time": "2026-04-15T17:39:51.221987654Z", "auth": {} }, "destinationAttributes": {} }, "serviceName": "secretmanager.googleapis.com", "methodName": "google.cloud.secretmanager.v1.SecretManagerService.DeleteSecret", "authorizationInfo": [ { "resource": "projects/fantasticlogs-prod/secrets/bowtruckle-prod-db-master-pass", "permission": "secretmanager.secrets.delete", "granted": true, "resourceAttributes": { "service": "secretmanager.googleapis.com", "name": "projects/fantasticlogs-prod/secrets/bowtruckle-prod-db-master-pass", "type": "secretmanager.googleapis.com/Secret" } } ], "resourceName": "projects/fantasticlogs-prod/secrets/bowtruckle-prod-db-master-pass", "request": { "@type": "type.googleapis.com/google.cloud.secretmanager.v1.DeleteSecretRequest", "name": "projects/fantasticlogs-prod/secrets/bowtruckle-prod-db-master-pass", "etag": "synthetic-before" }, "response": { "@type": "type.googleapis.com/google.protobuf.Empty" } }, "insertId": "evt010000000001", "resource": { "type": "audited_resource", "labels": { "project_id": "fantasticlogs-prod", "method": "google.cloud.secretmanager.v1.SecretManagerService.DeleteSecret", "service": "secretmanager.googleapis.com" } }, "timestamp": "2026-04-15T17:39:51.421987Z", "severity": "NOTICE", "logName": "projects/fantasticlogs-prod/logs/cloudaudit.googleapis.com%2Factivity", "receiveTimestamp": "2026-04-15T17:39:51.821987Z"}Sources
MITRE ATT&CK Mapping
Tactics: Impact
- T1485 — Data Destruction — Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources. Data destruction is likely to render stored data irrecoverable by forensic techniques through overwriting files or data on local and r...