Secrets manager new attacks

Author: JaimePolop

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-secrets-manager-post-exploitation.md

@@ -52,6 +52,42 @@ aws secretsmanager delete-secret \
     --recovery-window-in-days 7
 ```
 
+## secretsmanager:RestoreSecret
+
+It is possible to restore a secret, which allows the restoration of secrets that have been scheduled for deletion, since the minimum deletion period for secrets is 7 days and the maximum is 30 days. Together with the secretsmanager:GetSecretValue permission, this makes it possible to retrieve their contents.
+
+To recover a secret that is in the process of being deleted, you can use the following command:
+```bash
+aws secretsmanager restore-secret \
+  --secret-id <Secret_Name>
+```
+
+## secretsmanager:DeleteResourcePolicy, DoS
+
+This action allows deleting the resource policy that controls who can access a secret. This could lead to a DoS if the resource policy was configured to allow access to a specific set of users.
+
+To delete the resource policy:
+```bash
+aws secretsmanager delete-resource-policy \
+  --secret-id <Secret_Name>
+```
+
+## secretsmanager:UpdateSecretVersionStage, DoS
+
+The states of a secret are used to manage versions of a secret. AWSCURRENT marks the active version that applications use, AWSPREVIOUS keeps the previous version so that you can roll back if necessary, and AWSPENDING is used in the rotation process to prepare and validate a new version before making it the current one.
+
+Applications always read the version with AWSCURRENT. If someone moves that label to the wrong version, the apps will use invalid credentials and may fail.
+
+AWSPREVIOUS is not used automatically. However, if AWSCURRENT is removed or reassigned incorrectly, it may appear that everything is still running with the previous version.
+
+```bash
+aws secretsmanager update-secret-version-stage \
+  --secret-id <your-secret-name-or-arn> \
+  --version-stage AWSCURRENT \
+  --move-to-version-id <target-version-id> \
+  --remove-from-version-id <previous-version-id>
+```
+
 {{#include ../../../banners/hacktricks-training.md}}
 
 

src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-secrets-manager-privesc.md

@@ -18,6 +18,8 @@ An attacker with this permission can get the **saved value inside a secret** in
 aws secretsmanager get-secret-value --secret-id <secret_name> # Get value
 ```
 
+`secretsmanager:BatchGetSecretValue` needs also `secretsmanager:GetSecretValue` to retrieve the secrets.
+
 **Potential Impact:** Access high sensitive data inside AWS secrets manager service.
 
 ### `secretsmanager:GetResourcePolicy`, `secretsmanager:PutResourcePolicy`, (`secretsmanager:ListSecrets`)