Welcome to Tenable for AWS Secrets Manager

This document provides information and steps for integrating Tenable Vulnerability Management or Tenable Nessus with AWS Secrets Manager.

AWS Secrets Manager is an AWS service that allows you to store, rotate, and retrieve secrets such as database credentials, application credentials, OAuth tokens, API keys, usernames, and passwords. Tenable's integration with the AWS Secrets Manager API allows you to retrieve target login credentials directly from AWS at scan time, eliminating the need to store scan credentials in Tenable. The integration acts as a Privileged Access Management (PAM) integration: Tenable Vulnerability Management (or Tenable Security Center) pass the credential configuration down to Tenable Nessus, the scanner calls the AWS Secrets Manager API to fetch the secret value, and the returned username, password, and/or SSH key are used to authenticate to the scan target.

Tenable provides this integration as an authentication method for the following credential types:

• Host > Windows (SMB / WMI)

• Host > SSH

• Database (PostgreSQL, MongoDB, Cassandra, DB2, MySQL, SQL Server, Oracle)

• Miscellaneous > VMware ESX SOAP API

• Miscellaneous > VMware vCenter API

• Miscellaneous > Nutanix Prism Central

For more information, refer to the following product documentation:

• Tenable Vulnerability Management

• Tenable Nessus