AWS Secrets Manager

eventName	Description	Sample	Rule
any	Catch-all entry for AWS Secrets Manager rules that match the service but not a specific eventName.	N	N
GetSecretValue	Retrieves the value of a secret stored in AWS Secrets Manager.	Y	Y
BatchGetSecretValue	Retrieves the contents of the encrypted fields SecretString or SecretBinary for up to 20 secrets.	Y	Y
CancelRotateSecret	Turns off automatic rotation, and if a rotation is currently in progress, cancels the rotation.	Y	N
CreateSecret	Creates a new secret.	Y	N
DeleteResourcePolicy	Deletes the resource-based permission policy attached to the secret.	Y	N
DeleteSecret	Deletes a secret and all of its versions.	Y	N
DescribeSecret	Retrieves the details of a secret.	Y	N
GetRandomPassword	Generates a random password.	Y	N
GetResourcePolicy	Retrieves the JSON text of the resource-based policy document attached to the secret.	Y	N
ListSecrets	Lists the secrets that are stored by Secrets Manager in the Amazon Web Services account, not including secrets that are marked for deletion.	Y	N
ListSecretVersionIds	Lists the versions of a secret.	Y	N
PutResourcePolicy	Attaches a resource-based permission policy to a secret.	Y	N
PutSecretValue	Creates a new version of your secret by creating a new encrypted value and attaching it to the secret.	Y	N
RemoveRegionsFromReplication	For a secret that is replicated to other Regions, deletes the secret replicas from the Regions you specify.	Y	N
ReplicateSecretToRegions	Replicates the secret to a new Regions.	Y	N
RestoreSecret	Cancels the scheduled deletion of a secret by removing the DeletedDate time stamp.	Y	N
RotateSecret	Configures and starts the asynchronous process of rotating the secret.	Y	N
StopReplicationToReplica	Removes the link between the replica secret and the primary secret and promotes the replica to a primary secret in the replica Region.	Y	N
TagResource	Attaches tags to a secret.	Y	N
UntagResource	Removes specific tags from a secret.	Y	N
UpdateSecret	Modifies the details of a secret, including metadata and the secret value.	Y	N
UpdateSecretVersionStage	Modifies the staging labels attached to a version of a secret.	Y	N
ValidateResourcePolicy	Validates that a resource policy does not grant a wide range of principals access to your secret.	Y	N
CompleteRotation	CompleteRotation recorded by CloudTrail for AWS Secrets Manager. Observed in real CloudTrail; no AWS SDK operation model documents it, so no description is available from the SDK.	N	N
EndSecretVersionDelete	EndSecretVersionDelete recorded by CloudTrail for AWS Secrets Manager. Observed in real CloudTrail; no AWS SDK operation model documents it, so no description is available from the SDK.	N	N
ReplicationStarted	ReplicationStarted recorded by CloudTrail for AWS Secrets Manager. Observed in real CloudTrail; no AWS SDK operation model documents it, so no description is available from the SDK.	N	N
ReplicationSucceeded	ReplicationSucceeded recorded by CloudTrail for AWS Secrets Manager. Observed in real CloudTrail; no AWS SDK operation model documents it, so no description is available from the SDK.	N	N
RotationFailed	RotationFailed recorded by CloudTrail for AWS Secrets Manager. Observed in real CloudTrail; no AWS SDK operation model documents it, so no description is available from the SDK.	N	N
RotationStarted	RotationStarted recorded by CloudTrail for AWS Secrets Manager. Observed in real CloudTrail; no AWS SDK operation model documents it, so no description is available from the SDK.	N	N
RotationSucceeded	RotationSucceeded recorded by CloudTrail for AWS Secrets Manager. Observed in real CloudTrail; no AWS SDK operation model documents it, so no description is available from the SDK.	N	N
SecretVersionDeletion	SecretVersionDeletion recorded by CloudTrail for AWS Secrets Manager. Observed in real CloudTrail; no AWS SDK operation model documents it, so no description is available from the SDK.	N	N
StartSecretVersionDelete	StartSecretVersionDelete recorded by CloudTrail for AWS Secrets Manager. Observed in real CloudTrail; no AWS SDK operation model documents it, so no description is available from the SDK.	N	N

any: AWS Secrets Manager (catch-all)

Service: secretsmanager

Description

Catch-all entry for AWS Secrets Manager rules that match the service but not a specific eventName.

GetSecretValue

Service: secretsmanager

Description

Retrieves the value of a secret stored in AWS Secrets Manager.

CloudTrail management event, logged by default.

Example CloudTrail Event #

{
  "eventVersion": "1.11",
  "userIdentity": {
    "type": "Root",
    "principalId": "123456789012",
    "arn": "arn:aws:iam::123456789012:root",
    "accountId": "123456789012",
    "invokedBy": "secretsmanager.amazonaws.com"
  },
  "eventTime": "2026-07-28T19:59:51Z",
  "eventSource": "secretsmanager.amazonaws.com",
  "eventName": "GetSecretValue",
  "awsRegion": "us-west-1",
  "sourceIPAddress": "secretsmanager.amazonaws.com",
  "userAgent": "secretsmanager.amazonaws.com",
  "requestParameters": {
    "secretId": "arn:aws:secretsmanager:us-west-1:123456789012:secret:dw-harn-secretsmanager-bf42d165-RutLCm"
  },
  "responseElements": null,
  "requestID": "d85abf1b-9fe4-4aa7-b3c3-194b9b66d64f:arn:aws:secretsmanager:us-west-1:123456789012:secret:dw-harn-secretsmanager-bf42d165-RutLCm",
  "eventID": "968bdf94-604e-4991-97c4-932c97f6af3e",
  "readOnly": true,
  "eventType": "AwsApiCall",
  "managementEvent": true,
  "recipientAccountId": "123456789012",
  "eventCategory": "Management"
}

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`aws::errorCode` (panther rule field)	eq	`AccessDenied`	1 rule	panther
`aws::errorCode` (panther rule field)	is_not_null		1 rule	panther
`aws::errorMessage` (panther rule field)	is_not_null		1 rule	panther

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

Multiple Cloud Secrets Accessed by Source Address source high: This rule detects authenticated sessions accessing secret stores across multiple environments from the same source address within a short period of time, including cloud providers (AWS, GCP, Azure) and Kubernetes clusters. Adversaries with access to compromised credentials or session tokens may attempt to retrieve secrets from services such as AWS Secrets Manager, Google Secret Manager, Azure Key Vault, or Kubernetes Secrets in rapid succession to expand their access or exfiltrate sensitive information.T1555, T1555.006
First Time Seen AWS Secret Value Accessed in Secrets Manager source medium: An adversary with access to a compromised AWS service such as an EC2 instance, Lambda function, or other service may attempt to leverage the compromised service to access secrets in AWS Secrets Manager. This rule looks for the first time a specific user identity has programmatically retrieved a secret value from Secrets Manager using the GetSecretValue action. This rule assumes that AWS services such as Lambda functions and EC2 instances are setup with IAM role's assigned that have the necessary permissions to access the secrets in Secrets Manager. An adversary with access to a compromised AWS service would rely on its' attached role to access the secrets in Secrets Manager.T1555, T1555.006
AWS Secrets Manager Rapid Secrets Retrieval source medium: Identifies rapid secret retrieval activity from AWS Secrets Manager using the GetSecretValue or BatchGetSecretValue API actions. Adversaries who compromise an IAM user, instance role, or temporary credentials may attempt to enumerate or exfiltrate secrets in bulk to escalate privileges, move laterally, or gain persistence. This rule detects 20 or more unique secret retrievals by the same user identity within a short time window, which may indicate credential compromise or automated secret harvesting.T1213, T1213.006, T1555, T1555.006

Panther #

EC2 Secrets Manager Retrieve Secrets source informational: An attacker attempted to retrieve a high number of Secrets Manager secrets, through secretsmanager:GetSecretValue.T1552

BatchGetSecretValue

Service: secretsmanager

Description

Retrieves the contents of the encrypted fields SecretString or SecretBinary for up to 20 secrets.

CloudTrail management event, logged by default.

Example CloudTrail Event #

{
  "eventVersion": "1.11",
  "userIdentity": {
    "type": "Root",
    "principalId": "123456789012",
    "arn": "arn:aws:iam::123456789012:root",
    "accountId": "123456789012",
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE"
  },
  "eventTime": "2026-07-28T19:59:51Z",
  "eventSource": "secretsmanager.amazonaws.com",
  "eventName": "BatchGetSecretValue",
  "awsRegion": "us-west-1",
  "sourceIPAddress": "203.0.113.5",
  "userAgent": "aws-cli/2.34.28 md/awscrt#0.31.2 ua/2.1 os/linux#6.1.0-51-amd64 md/arch#x86_64 lang/python#3.14.3 md/pyimpl#CPython m/Z,E,n,b cfg/retry-mode#standard md/installer#exe md/distrib#debian.12 md/prompt#off md/command#secretsmanager.batch-get-secret-value",
  "requestParameters": {
    "secretIdList": [
      "dw-harn-secretsmanager-bf42d165"
    ]
  },
  "responseElements": null,
  "requestID": "d85abf1b-9fe4-4aa7-b3c3-194b9b66d64f",
  "eventID": "3078c035-3630-426b-a7b2-962076b4f7e2",
  "readOnly": true,
  "eventType": "AwsApiCall",
  "managementEvent": true,
  "recipientAccountId": "123456789012",
  "eventCategory": "Management",
  "tlsDetails": {
    "tlsVersion": "TLSv1.3",
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "secretsmanager.us-west-1.amazonaws.com",
    "keyExchange": "x25519"
  }
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Panther #

AWS Secrets Manager Batch Retrieve Secrets source informational: An attacker attempted to retrieve a high number of Secrets Manager secrets by batch, through secretsmanager:BatchGetSecretValue (released Novemeber 2023). An attacker may attempt to retrieve a high number of secrets by batch, to avoid detection and generate fewer calls. Note that the batch size is limited to 20 secrets.T1552
AWS Secrets Manager Batch Retrieve Secrets Catch-All source informational: An attacker attempted to retrieve a high number of Secrets Manager secrets by batch, through secretsmanager:BatchGetSecretValue (released Novemeber 2023). An attacker may attempt to retrieve a high number of secrets by batch, to avoid detection and generate fewer calls. Note that the batch size is limited to 20 secrets. Although BatchGetSecretValue requires a list of secret IDs or a filter, an attacker may use a catch-all filter to retrieve all secrets by batch. This rule identifies BatchGetSecretValue events with a catch-all filter.T1552
AWS Secrets Manager Retrieve Secrets Multi-Region source informational: An attacker attempted to retrieve a high number of Secrets Manager secrets by batch, through secretsmanager:BatchGetSecretValue (released Novemeber 2023). An attacker may attempt to retrieve a high number of secrets by batch, to avoid detection and generate fewer calls. Note that the batch size is limited to 20 secrets. This rule identifies BatchGetSecretValue events for multiple regions in a short period of time.T1552

CancelRotateSecret

Service: secretsmanager

Description

Turns off automatic rotation, and if a rotation is currently in progress, cancels the rotation.

CloudTrail management event, logged by default.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "ResourceNotFoundException",
  "errorMessage": "Secrets Manager can't find the specified secret.",
  "eventCategory": "Management",
  "eventID": "835600d0-318b-4fc1-97ef-3cf828e163cf",
  "eventName": "CancelRotateSecret",
  "eventSource": "secretsmanager.amazonaws.com",
  "eventTime": "2026-06-29T19:26:36Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "81036164-5b83-4be4-80aa-11a63933932b",
  "requestParameters": {
    "secretId": "ddddd"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "secretsmanager.us-west-1.amazonaws.com",
    "keyExchange": "x25519",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

CreateSecret

Service: secretsmanager

Description

Creates a new secret.

CloudTrail management event, logged by default.

Example CloudTrail Event #

{
  "eventVersion": "1.11",
  "userIdentity": {
    "type": "Root",
    "principalId": "123456789012",
    "arn": "arn:aws:iam::123456789012:root",
    "accountId": "123456789012",
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE"
  },
  "eventTime": "2026-07-28T19:59:48Z",
  "eventSource": "secretsmanager.amazonaws.com",
  "eventName": "CreateSecret",
  "awsRegion": "us-west-1",
  "sourceIPAddress": "203.0.113.5",
  "userAgent": "aws-cli/2.34.28 md/awscrt#0.31.2 ua/2.1 os/linux#6.1.0-51-amd64 md/arch#x86_64 lang/python#3.14.3 md/pyimpl#CPython m/Z,E,n,b cfg/retry-mode#standard md/installer#exe md/distrib#debian.12 md/prompt#off md/command#secretsmanager.create-secret",
  "requestParameters": {
    "name": "dw-harn-secretsmanager-bf42d165",
    "clientRequestToken": "2e340958-d881-471b-a9de-c8d6d819785a",
    "forceOverwriteReplicaSecret": false
  },
  "responseElements": {
    "arn": "arn:aws:secretsmanager:us-west-1:123456789012:secret:dw-harn-secretsmanager-bf42d165-RutLCm"
  },
  "requestID": "fe149540-de75-47ed-82cc-e6659aa8b261",
  "eventID": "81ca03f8-881a-495e-8061-9e846d36e303",
  "readOnly": false,
  "eventType": "AwsApiCall",
  "managementEvent": true,
  "recipientAccountId": "123456789012",
  "eventCategory": "Management",
  "tlsDetails": {
    "tlsVersion": "TLSv1.3",
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "secretsmanager.us-west-1.amazonaws.com",
    "keyExchange": "x25519"
  }
}

DeleteResourcePolicy

Service: secretsmanager

Description

Deletes the resource-based permission policy attached to the secret.

CloudTrail management event, logged by default.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "52049e82-dcee-4f3a-90d4-926d06c2d712",
  "eventName": "DeleteResourcePolicy",
  "eventSource": "secretsmanager.amazonaws.com",
  "eventTime": "2026-06-29T19:12:19Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "92b52f83-2d72-4f1d-bc63-00c0813153cd",
  "requestParameters": {
    "secretId": "arn:aws:secretsmanager:us-west-1:123456789012:secret:dwfix-secret-MC49Eq"
  },
  "resources": [
    {
      "ARN": "arn:aws:secretsmanager:us-west-1:123456789012:secret:dwfix-secret-MC49Eq",
      "accountId": "123456789012",
      "type": "AWS::SecretsManager::Secret"
    }
  ],
  "responseElements": {
    "arn": "arn:aws:secretsmanager:us-west-1:123456789012:secret:dwfix-secret-MC49Eq",
    "name": "dwfix-secret"
  },
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "secretsmanager.us-west-1.amazonaws.com",
    "keyExchange": "x25519",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

DeleteSecret

Service: secretsmanager

Description

Deletes a secret and all of its versions.

CloudTrail management event, logged by default.

Example CloudTrail Event #

{
  "eventVersion": "1.11",
  "userIdentity": {
    "type": "Root",
    "principalId": "123456789012",
    "arn": "arn:aws:iam::123456789012:root",
    "accountId": "123456789012",
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE"
  },
  "eventTime": "2026-07-28T19:59:53Z",
  "eventSource": "secretsmanager.amazonaws.com",
  "eventName": "DeleteSecret",
  "awsRegion": "us-west-1",
  "sourceIPAddress": "203.0.113.5",
  "userAgent": "aws-cli/2.34.28 md/awscrt#0.31.2 ua/2.1 os/linux#6.1.0-51-amd64 md/arch#x86_64 lang/python#3.14.3 md/pyimpl#CPython m/Z,E,n,b cfg/retry-mode#standard md/installer#exe md/distrib#debian.12 md/prompt#off md/command#secretsmanager.delete-secret",
  "requestParameters": {
    "secretId": "dw-harn-secretsmanager-bf42d165",
    "forceDeleteWithoutRecovery": true
  },
  "responseElements": {
    "deletionDate": "2026-07-28T19:59:53Z",
    "name": "dw-harn-secretsmanager-bf42d165",
    "arn": "arn:aws:secretsmanager:us-west-1:123456789012:secret:dw-harn-secretsmanager-bf42d165-RutLCm"
  },
  "requestID": "6f3ec879-0bd9-4b47-af3b-54b3e0384d18",
  "eventID": "5fff066c-636a-4fbd-ad5e-19dc5db70359",
  "readOnly": false,
  "eventType": "AwsApiCall",
  "managementEvent": true,
  "recipientAccountId": "123456789012",
  "eventCategory": "Management",
  "tlsDetails": {
    "tlsVersion": "TLSv1.3",
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "secretsmanager.us-west-1.amazonaws.com",
    "keyExchange": "x25519"
  }
}

DescribeSecret

Service: secretsmanager

Description

Retrieves the details of a secret.

Example CloudTrail Event #

{
  "eventVersion": "1.11",
  "userIdentity": {
    "type": "Root",
    "principalId": "123456789012",
    "arn": "arn:aws:iam::123456789012:root",
    "accountId": "123456789012",
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE"
  },
  "eventTime": "2026-07-28T19:59:49Z",
  "eventSource": "secretsmanager.amazonaws.com",
  "eventName": "DescribeSecret",
  "awsRegion": "us-west-1",
  "sourceIPAddress": "203.0.113.5",
  "userAgent": "aws-cli/2.34.28 md/awscrt#0.31.2 ua/2.1 os/linux#6.1.0-51-amd64 md/arch#x86_64 lang/python#3.14.3 md/pyimpl#CPython m/Z,E,n,b cfg/retry-mode#standard md/installer#exe md/distrib#debian.12 md/prompt#off md/command#secretsmanager.describe-secret",
  "requestParameters": {
    "secretId": "dw-harn-secretsmanager-bf42d165"
  },
  "responseElements": null,
  "requestID": "98843f25-2605-4e97-baaf-746d722a9e32",
  "eventID": "cfea85d2-e05d-4ca1-99ad-d0d83076b724",
  "readOnly": true,
  "eventType": "AwsApiCall",
  "managementEvent": true,
  "recipientAccountId": "123456789012",
  "eventCategory": "Management",
  "tlsDetails": {
    "tlsVersion": "TLSv1.3",
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "secretsmanager.us-west-1.amazonaws.com",
    "keyExchange": "x25519"
  }
}

GetRandomPassword

Service: secretsmanager

Description

Generates a random password.

Example CloudTrail Event #

{
  "awsRegion": "us-east-1",
  "errorCode": "AccessDenied",
  "errorMessage": "User: arn:aws:iam::811596193553:user/Level6 is not authorized to perform: secretsmanager:GetRandomPassword",
  "eventID": "bf8dedd7-424c-41c6-b2b8-2b9cbde5d219",
  "eventName": "GetRandomPassword",
  "eventSource": "secretsmanager.amazonaws.com",
  "eventTime": "2019-07-25T09:41:03Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.05",
  "recipientAccountId": "811596193553",
  "requestID": "0639ac68-14dc-4bbb-be4a-a8de95de53a1",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "248.251.245.4",
  "userAgent": "Boto3/1.9.39 Python/2.7.16 Linux/4.19.0-kali5-amd64 Botocore/1.12.86",
  "userIdentity": {
    "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD",
    "accountId": "811596193553",
    "arn": "arn:aws:iam::811596193553:user/Level6",
    "principalId": "AIDADO2GQD0K8TEF7KW1V",
    "type": "IAMUser",
    "userName": "Level6"
  }
}

References #

Sample log: flaws.cloud CloudTrail training logs

GetResourcePolicy

Service: secretsmanager

Description

Retrieves the JSON text of the resource-based policy document attached to the secret.

Example CloudTrail Event #

{
  "awsRegion": "us-east-1",
  "eventCategory": "Management",
  "eventID": "2499febe-be52-4707-b0be-2ff6d4f9116a",
  "eventName": "GetResourcePolicy",
  "eventSource": "secretsmanager.amazonaws.com",
  "eventTime": "2023-07-10T11:57:48Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.08",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123837392027",
  "requestID": "aee24b80-6db5-411d-a4e9-9fb877ffede9",
  "requestParameters": {
    "secretId": "arn:aws:secretsmanager:us-east-1:123837392027:secret:stratus-red-team-retrieve-secret-8-2aONLk"
  },
  "responseElements": null,
  "sourceIPAddress": "192.168.10.20",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "secretsmanager.us-east-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "APN/1.0 HashiCorp/1.0 Terraform/1.1.2 (+https://www.terraform.io) terraform-provider-aws/3.76.1 (+https://registry.terraform.io/providers/hashicorp/aws) aws-sdk-go/1.44.157 (go1.19.3; linux; amd64) stratus-red-team_561fe49b-e6b4-44da-a587-f2c718eb578a HashiCorp-terraform-exec/0.17.3",
  "userIdentity": {
    "accessKeyId": "AKIATFQR7NSC8Q4X20BJ",
    "accountId": "123837392027",
    "arn": "arn:aws:iam::123837392027:user/bert-jan",
    "principalId": "AIDATFQR7NSC5AU2ZV3IE",
    "type": "IAMUser",
    "userName": "bert-jan"
  }
}

References #

Sample log: invictus-ir/aws_dataset

ListSecrets

Service: secretsmanager

Description

Lists the secrets that are stored by Secrets Manager in the Amazon Web Services account, not including secrets that are marked for deletion.

CloudTrail management event, logged by default.

Example CloudTrail Event #

{
  "awsRegion": "us-east-1",
  "eventCategory": "Management",
  "eventID": "b755ffb1-1739-4a64-a5d2-6f74e5b2f4f2",
  "eventName": "ListSecrets",
  "eventSource": "secretsmanager.amazonaws.com",
  "eventTime": "2023-07-10T11:57:51Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.08",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123837392027",
  "requestID": "a0428c66-bbb1-4813-8b62-92e294b6766a",
  "requestParameters": {
    "filters": [
      {
        "key": "tag-key",
        "values": [
          "StratusRedTeam"
        ]
      }
    ],
    "maxResults": 100
  },
  "responseElements": null,
  "sourceIPAddress": "192.168.10.20",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "secretsmanager.us-east-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "stratus-red-team_561fe49b-e6b4-44da-a587-f2c718eb578a",
  "userIdentity": {
    "accessKeyId": "AKIATFQR7NSC8Q4X20BJ",
    "accountId": "123837392027",
    "arn": "arn:aws:iam::123837392027:user/bert-jan",
    "principalId": "AIDATFQR7NSC5AU2ZV3IE",
    "type": "IAMUser",
    "userName": "bert-jan"
  }
}

References #

Sample log: invictus-ir/aws_dataset

ListSecretVersionIds

Service: secretsmanager

Description

Lists the versions of a secret.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "ResourceNotFoundException",
  "errorMessage": "Secrets Manager can't find the specified secret.",
  "eventCategory": "Management",
  "eventID": "49188d4d-81c1-4a2c-b58e-424823f16880",
  "eventName": "ListSecretVersionIds",
  "eventSource": "secretsmanager.amazonaws.com",
  "eventTime": "2026-06-29T18:46:07Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "9b4ceeb7-effc-4dc5-957b-4974c3afcea2",
  "requestParameters": {
    "secretId": "ddddd"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "secretsmanager.us-west-1.amazonaws.com",
    "keyExchange": "x25519",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

PutResourcePolicy

Service: secretsmanager

Description

Attaches a resource-based permission policy to a secret.

CloudTrail management event, logged by default.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "fe25737f-adcd-4e55-abaf-abf57e3704df",
  "eventName": "PutResourcePolicy",
  "eventSource": "secretsmanager.amazonaws.com",
  "eventTime": "2026-06-29T19:12:19Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "216e184c-2667-495e-b02e-fa393de0d031",
  "requestParameters": {
    "resourcePolicy": {
      "Version": "2012-10-17",
      "Statement": [
        {
          "Effect": "Deny",
          "Principal": {
            "AWS": "arn:aws:iam::123456789012:root"
          },
          "Action": "secretsmanager:DeleteSecret",
          "Resource": "*"
        }
      ]
    },
    "secretId": "arn:aws:secretsmanager:us-west-1:123456789012:secret:dwfix-secret-MC49Eq"
  },
  "resources": [
    {
      "ARN": "arn:aws:secretsmanager:us-west-1:123456789012:secret:dwfix-secret-MC49Eq",
      "accountId": "123456789012",
      "type": "AWS::SecretsManager::Secret"
    }
  ],
  "responseElements": {
    "arn": "arn:aws:secretsmanager:us-west-1:123456789012:secret:dwfix-secret-MC49Eq",
    "name": "dwfix-secret"
  },
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "secretsmanager.us-west-1.amazonaws.com",
    "keyExchange": "x25519",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

PutSecretValue

Service: secretsmanager

Description

Creates a new version of your secret by creating a new encrypted value and attaching it to the secret.

CloudTrail management event, logged by default.

Example CloudTrail Event #

{
  "awsRegion": "us-east-1",
  "eventCategory": "Management",
  "eventID": "f8dc527b-c784-4158-b0a1-ecce224f9965",
  "eventName": "PutSecretValue",
  "eventSource": "secretsmanager.amazonaws.com",
  "eventTime": "2023-07-10T11:57:49Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.08",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123837392027",
  "requestID": "4b560905-3696-40ae-9fbb-ea826d8cfd2d",
  "requestParameters": {
    "clientRequestToken": "9128BF7A-DA94-40C0-873D-BCDF8A4013DC",
    "secretId": "arn:aws:secretsmanager:us-east-1:123837392027:secret:stratus-red-team-retrieve-secret-8-2aONLk"
  },
  "responseElements": {
    "arn": "arn:aws:secretsmanager:us-east-1:123837392027:secret:stratus-red-team-retrieve-secret-8-2aONLk"
  },
  "sourceIPAddress": "192.168.10.20",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "secretsmanager.us-east-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "APN/1.0 HashiCorp/1.0 Terraform/1.1.2 (+https://www.terraform.io) terraform-provider-aws/3.76.1 (+https://registry.terraform.io/providers/hashicorp/aws) aws-sdk-go/1.44.157 (go1.19.3; linux; amd64) stratus-red-team_561fe49b-e6b4-44da-a587-f2c718eb578a HashiCorp-terraform-exec/0.17.3",
  "userIdentity": {
    "accessKeyId": "AKIATFQR7NSC8Q4X20BJ",
    "accountId": "123837392027",
    "arn": "arn:aws:iam::123837392027:user/bert-jan",
    "principalId": "AIDATFQR7NSC5AU2ZV3IE",
    "type": "IAMUser",
    "userName": "bert-jan"
  }
}

References #

Sample log: invictus-ir/aws_dataset

RemoveRegionsFromReplication

Service: secretsmanager

Description

For a secret that is replicated to other Regions, deletes the secret replicas from the Regions you specify.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "ValidationException",
  "errorMessage": "1 validation error detected: Value '[ddddd]' at 'removeReplicaRegions' failed to satisfy constraint: Member must satisfy constraint: [Member must have length less than or equal to 128, Member must have length greater than or equal to 1, Member must satisfy regular expression pattern: ^([a-z]+-)+\\d+$]",
  "eventCategory": "Management",
  "eventID": "d49150df-d55d-4245-b900-ee80376b24af",
  "eventName": "RemoveRegionsFromReplication",
  "eventSource": "secretsmanager.amazonaws.com",
  "eventTime": "2026-06-29T19:26:36Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "592f9a03-8df9-429e-96da-5e756345cac4",
  "requestParameters": {
    "removeReplicaRegions": [
      "ddddd"
    ],
    "secretId": "ddddd"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "secretsmanager.us-west-1.amazonaws.com",
    "keyExchange": "x25519",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

ReplicateSecretToRegions

Service: secretsmanager

Description

Replicates the secret to a new Regions.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "51938ea9-0352-40d5-a451-3604701036e8",
  "eventName": "ReplicateSecretToRegions",
  "eventSource": "secretsmanager.amazonaws.com",
  "eventTime": "2026-06-29T20:58:36Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "ea34c437-933d-4395-a34e-1a89631ac7f0",
  "requestParameters": {
    "addReplicaRegions": [
      {
        "region": "us-east-2"
      }
    ],
    "forceOverwriteReplicaSecret": false,
    "secretId": "dwfix-secretsmanager-test"
  },
  "responseElements": {
    "arn": "arn:aws:secretsmanager:us-west-1:123456789012:secret:dwfix-secretsmanager-test-KKKCRS",
    "replicationStatus": [
      {
        "kmsKeyId": "alias/aws/secretsmanager",
        "region": "us-east-2",
        "status": "InProgress"
      }
    ]
  },
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "secretsmanager.us-west-1.amazonaws.com",
    "keyExchange": "x25519",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/D,b,n,Z cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

RestoreSecret

Service: secretsmanager

Description

Cancels the scheduled deletion of a secret by removing the DeletedDate time stamp.

CloudTrail management event, logged by default.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "d4354f53-961f-441b-b663-71f887a83a60",
  "eventName": "RestoreSecret",
  "eventSource": "secretsmanager.amazonaws.com",
  "eventTime": "2026-06-29T20:58:43Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "beb31ff9-fbbf-437e-9e71-7bff220d6456",
  "requestParameters": {
    "secretId": "dwfix-secretsmanager-test"
  },
  "responseElements": {
    "arn": "arn:aws:secretsmanager:us-west-1:123456789012:secret:dwfix-secretsmanager-test-KKKCRS",
    "name": "dwfix-secretsmanager-test"
  },
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "secretsmanager.us-west-1.amazonaws.com",
    "keyExchange": "x25519",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/D,b,n,Z cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

RotateSecret

Service: secretsmanager

Description

Configures and starts the asynchronous process of rotating the secret.

CloudTrail management event, logged by default.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "InvalidRequestException",
  "errorMessage": "No Lambda rotation function ARN is associated with this secret.",
  "eventCategory": "Management",
  "eventID": "d7a39d6e-ea5b-4be3-af2c-abdc6938eadb",
  "eventName": "RotateSecret",
  "eventSource": "secretsmanager.amazonaws.com",
  "eventTime": "2026-06-29T20:58:41Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "510a50dd-bca7-4eb5-9553-f40b457b201f",
  "requestParameters": {
    "clientRequestToken": "d2ec81ec-ac16-45b0-a82c-dff49b18150e",
    "rotateImmediately": false,
    "secretId": "dwfix-secretsmanager-test"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "secretsmanager.us-west-1.amazonaws.com",
    "keyExchange": "x25519",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/D,b,n,Z cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

StopReplicationToReplica

Service: secretsmanager

Description

Removes the link between the replica secret and the primary secret and promotes the replica to a primary secret in the replica Region.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "ResourceNotFoundException",
  "errorMessage": "Secrets Manager can't find the specified secret.",
  "eventCategory": "Management",
  "eventID": "a229a48b-a065-4081-8c7d-fc4540502fcd",
  "eventName": "StopReplicationToReplica",
  "eventSource": "secretsmanager.amazonaws.com",
  "eventTime": "2026-06-29T19:26:36Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "ffce02a5-d534-4749-9b8a-9ebf932ac3a1",
  "requestParameters": {
    "secretId": "ddddd"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "secretsmanager.us-west-1.amazonaws.com",
    "keyExchange": "x25519",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

TagResource

Service: secretsmanager

Description

Attaches tags to a secret.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "b87a1b6d-4222-497f-9999-e88df6fa8f87",
  "eventName": "TagResource",
  "eventSource": "secretsmanager.amazonaws.com",
  "eventTime": "2026-06-29T19:12:19Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "6609ab5e-ce79-4b72-a3aa-68306e47b41c",
  "requestParameters": {
    "secretId": "arn:aws:secretsmanager:us-west-1:123456789012:secret:dwfix-secret-MC49Eq",
    "tags": [
      {
        "key": "dw",
        "value": "f"
      }
    ]
  },
  "resources": [
    {
      "ARN": "arn:aws:secretsmanager:us-west-1:123456789012:secret:dwfix-secret-MC49Eq",
      "accountId": "123456789012",
      "type": "AWS::SecretsManager::Secret"
    }
  ],
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "secretsmanager.us-west-1.amazonaws.com",
    "keyExchange": "x25519",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

UntagResource

Service: secretsmanager

Description

Removes specific tags from a secret.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "968315ec-e9a3-44bf-89f0-68611650cf59",
  "eventName": "UntagResource",
  "eventSource": "secretsmanager.amazonaws.com",
  "eventTime": "2026-06-29T19:12:19Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "f41e5fa7-34fa-4227-90eb-5cef355e8e6d",
  "requestParameters": {
    "secretId": "arn:aws:secretsmanager:us-west-1:123456789012:secret:dwfix-secret-MC49Eq",
    "tagKeys": [
      "dw"
    ]
  },
  "resources": [
    {
      "ARN": "arn:aws:secretsmanager:us-west-1:123456789012:secret:dwfix-secret-MC49Eq",
      "accountId": "123456789012",
      "type": "AWS::SecretsManager::Secret"
    }
  ],
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "secretsmanager.us-west-1.amazonaws.com",
    "keyExchange": "x25519",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

UpdateSecret

Service: secretsmanager

Description

Modifies the details of a secret, including metadata and the secret value.

CloudTrail management event, logged by default.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "fc13c15e-ab65-4b59-9a1f-069595887f44",
  "eventName": "UpdateSecret",
  "eventSource": "secretsmanager.amazonaws.com",
  "eventTime": "2026-06-29T19:12:19Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "8c4a7de0-0c6f-44dc-bb35-eeb3ee4b444c",
  "requestParameters": {
    "clientRequestToken": "b5e58854-fa27-45c8-a892-28e04a856218",
    "description": "dw",
    "secretId": "arn:aws:secretsmanager:us-west-1:123456789012:secret:dwfix-secret-MC49Eq"
  },
  "resources": [
    {
      "ARN": "arn:aws:secretsmanager:us-west-1:123456789012:secret:dwfix-secret-MC49Eq",
      "accountId": "123456789012",
      "type": "AWS::SecretsManager::Secret"
    }
  ],
  "responseElements": {
    "arn": "arn:aws:secretsmanager:us-west-1:123456789012:secret:dwfix-secret-MC49Eq"
  },
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "secretsmanager.us-west-1.amazonaws.com",
    "keyExchange": "x25519",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

UpdateSecretVersionStage

Service: secretsmanager

Description

Modifies the staging labels attached to a version of a secret.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "ResourceNotFoundException",
  "errorMessage": "Secrets Manager can't find the specified secret.",
  "eventCategory": "Management",
  "eventID": "67e7c4dc-eefb-473b-b04a-fa2f9edd9ea5",
  "eventName": "UpdateSecretVersionStage",
  "eventSource": "secretsmanager.amazonaws.com",
  "eventTime": "2026-06-29T19:26:36Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "a8c8c0b3-5cd8-4bee-a269-46a906f0a3e6",
  "requestParameters": {
    "secretId": "ddddd",
    "versionStage": "ddddd"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "secretsmanager.us-west-1.amazonaws.com",
    "keyExchange": "x25519",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

ValidateResourcePolicy

Service: secretsmanager

Description

Validates that a resource policy does not grant a wide range of principals access to your secret.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "75c0824e-d70c-4bc7-a5b6-856a3cd58af9",
  "eventName": "ValidateResourcePolicy",
  "eventSource": "secretsmanager.amazonaws.com",
  "eventTime": "2026-06-29T20:58:35Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "e7f3c0c6-ba02-4ca6-9f71-ff986d7565a5",
  "requestParameters": {
    "resourcePolicy": {
      "Version": "2012-10-17",
      "Statement": [
        {
          "Sid": "AllowSameAccount",
          "Effect": "Allow",
          "Principal": {
            "AWS": "arn:aws:iam::123456789012:root"
          },
          "Action": "secretsmanager:GetSecretValue",
          "Resource": "*"
        }
      ]
    },
    "secretId": "dwfix-secretsmanager-test"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "secretsmanager.us-west-1.amazonaws.com",
    "keyExchange": "x25519",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/D,b,n,Z cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

CompleteRotation

Service: secretsmanager

Description

CompleteRotation recorded by CloudTrail for AWS Secrets Manager. Observed in real CloudTrail; no AWS SDK operation model documents it, so no description is available from the SDK.

Example CloudTrail Event #

This is a projected export row, not a complete CloudTrail record: it shows only the envelope columns a SIEM export retained. The export never carried userIdentity, requestParameters, responseElements, sourceIPAddress, recipientAccountId, eventCategory, so their absence here says nothing about the real event. Account identifiers, ARNs and endpoint hostnames in eventID, requestID, resources, tlsDetails, userAgent are replaced with the placeholders AWS uses in its own documentation, so those values are structurally real but not the originals. errorMessage is withheld: it is free-form prose that names customer resources, which no substitution rule can find reliably. eventTime is withheld because the export renders it in the exporting system's local timezone rather than the UTC a CloudTrail record carries.

{
  "eventVersion": "1.11",
  "eventID": "ab0cb5e6-1afa-3374-ae64-70bb95fd6fb8",
  "eventSource": "secretsmanager.amazonaws.com",
  "eventName": "CompleteRotation",
  "awsRegion": "us-east-1",
  "eventType": "AwsApiCall",
  "readOnly": false,
  "managementEvent": true,
  "requestID": "349fdf6d-f5b3-4060-ac41-b2f53d2cfc61",
  "userAgent": "rds.amazonaws.com",
  "resources": [
    {
      "accountId": "123456789012",
      "type": "AWS::SecretsManager::Secret",
      "ARN": "arn:aws:secretsmanager:us-east-1:123456789012:secret:EXAMPLE"
    }
  ]
}

EndSecretVersionDelete

Service: secretsmanager

Description

EndSecretVersionDelete recorded by CloudTrail for AWS Secrets Manager. Observed in real CloudTrail; no AWS SDK operation model documents it, so no description is available from the SDK.

Example CloudTrail Event #

{
  "eventVersion": "1.11",
  "eventID": "7f477199-92de-4fc7-aa3a-6eab0a7161d9",
  "eventSource": "secretsmanager.amazonaws.com",
  "eventName": "EndSecretVersionDelete",
  "awsRegion": "us-west-2",
  "eventType": "AwsServiceEvent",
  "readOnly": false,
  "managementEvent": true,
  "requestID": "SecretDeleteMessage:arn:aws:secretsmanager:us-west-2:123456789012:secret:/EXAMPLE",
  "userAgent": "secretsmanager.amazonaws.com"
}

ReplicationStarted

Service: secretsmanager

Description

ReplicationStarted recorded by CloudTrail for AWS Secrets Manager. Observed in real CloudTrail; no AWS SDK operation model documents it, so no description is available from the SDK.

Example CloudTrail Event #

{
  "eventVersion": "1.11",
  "eventID": "ce17552f-f0cb-49e9-af6a-b2f3f2ec3117",
  "eventSource": "secretsmanager.amazonaws.com",
  "eventName": "ReplicationStarted",
  "awsRegion": "us-east-1",
  "eventType": "AwsServiceEvent",
  "readOnly": false,
  "managementEvent": true,
  "requestID": "Replication-arn:aws:secretsmanager:us-east-1:123456789012:secret:/EXAMPLE",
  "userAgent": "secretsmanager.amazonaws.com"
}

ReplicationSucceeded

Service: secretsmanager

Description

ReplicationSucceeded recorded by CloudTrail for AWS Secrets Manager. Observed in real CloudTrail; no AWS SDK operation model documents it, so no description is available from the SDK.

Example CloudTrail Event #

{
  "eventVersion": "1.11",
  "eventID": "2fdfd7cf-0442-48aa-8283-41f821a281a7",
  "eventSource": "secretsmanager.amazonaws.com",
  "eventName": "ReplicationSucceeded",
  "awsRegion": "us-east-1",
  "eventType": "AwsServiceEvent",
  "readOnly": false,
  "managementEvent": true,
  "requestID": "StatusMessage-Metadata-arn:aws:secretsmanager:us-east-1:123456789012:secret:/EXAMPLE",
  "userAgent": "secretsmanager.amazonaws.com"
}

RotationFailed

Service: secretsmanager

Description

RotationFailed recorded by CloudTrail for AWS Secrets Manager. Observed in real CloudTrail; no AWS SDK operation model documents it, so no description is available from the SDK.

Example CloudTrail Event #

{
  "eventVersion": "1.11",
  "eventID": "b5da36a3-2631-4f26-839f-0c3a9b7a67b4",
  "eventSource": "secretsmanager.amazonaws.com",
  "eventName": "RotationFailed",
  "awsRegion": "us-east-1",
  "eventType": "AwsServiceEvent",
  "readOnly": false,
  "managementEvent": true,
  "requestID": "Rotation-arn:aws:secretsmanager:us-east-1:123456789012:secret:/EXAMPLE",
  "userAgent": "secretsmanager.amazonaws.com"
}

RotationStarted

Service: secretsmanager

Description

RotationStarted recorded by CloudTrail for AWS Secrets Manager. Observed in real CloudTrail; no AWS SDK operation model documents it, so no description is available from the SDK.

Example CloudTrail Event #

{
  "eventVersion": "1.11",
  "eventID": "4471c919-7a4d-4cc5-801c-395bec922302",
  "eventSource": "secretsmanager.amazonaws.com",
  "eventName": "RotationStarted",
  "awsRegion": "us-east-1",
  "eventType": "AwsServiceEvent",
  "readOnly": false,
  "managementEvent": true,
  "requestID": "Rotation-arn:aws:secretsmanager:us-east-1:123456789012:secret:/EXAMPLE",
  "userAgent": "secretsmanager.amazonaws.com"
}

RotationSucceeded

Service: secretsmanager

Description

RotationSucceeded recorded by CloudTrail for AWS Secrets Manager. Observed in real CloudTrail; no AWS SDK operation model documents it, so no description is available from the SDK.

Example CloudTrail Event #

{
  "eventVersion": "1.11",
  "eventID": "c7bc9b94-e1d1-45ae-b63f-b7f3768ba4b5",
  "eventSource": "secretsmanager.amazonaws.com",
  "eventName": "RotationSucceeded",
  "awsRegion": "us-east-1",
  "eventType": "AwsServiceEvent",
  "readOnly": false,
  "managementEvent": true,
  "requestID": "Rotation-arn:aws:secretsmanager:us-east-1:123456789012:secret:dev/EXAMPLE",
  "userAgent": "secretsmanager.amazonaws.com"
}

SecretVersionDeletion

Service: secretsmanager

Description

SecretVersionDeletion recorded by CloudTrail for AWS Secrets Manager. Observed in real CloudTrail; no AWS SDK operation model documents it, so no description is available from the SDK.

Example CloudTrail Event #

{
  "eventVersion": "1.11",
  "eventID": "e2ccf9e4-9c1a-4a23-8685-e280de488b04",
  "eventSource": "secretsmanager.amazonaws.com",
  "eventName": "SecretVersionDeletion",
  "awsRegion": "us-east-2",
  "eventType": "AwsServiceEvent",
  "readOnly": false,
  "managementEvent": true,
  "requestID": "PruneMessage_2026-07-28_Reschedule_arn:aws:secretsmanager:us-east-2:123456789012:secret:credentials-sync/EXAMPLE",
  "userAgent": "secretsmanager.amazonaws.com"
}

StartSecretVersionDelete

Service: secretsmanager

Description

StartSecretVersionDelete recorded by CloudTrail for AWS Secrets Manager. Observed in real CloudTrail; no AWS SDK operation model documents it, so no description is available from the SDK.

Example CloudTrail Event #

{
  "eventVersion": "1.11",
  "eventID": "90553498-9d83-4d7f-9859-89a3fdc5a6be",
  "eventSource": "secretsmanager.amazonaws.com",
  "eventName": "StartSecretVersionDelete",
  "awsRegion": "us-west-2",
  "eventType": "AwsServiceEvent",
  "readOnly": false,
  "managementEvent": true,
  "requestID": "SecretDeleteMessage:arn:aws:secretsmanager:us-west-2:123456789012:secret:/EXAMPLE",
  "userAgent": "secretsmanager.amazonaws.com"
}