What information does the AWS Secrets Manager integration collect?

The AWS Secrets Manager integration collects configuration values that you supply in the Tenable credential UI, and retrieves the secret based on those values from AWS at scan time.

AWS Secrets Manager-related configurations:

  • AWS Region (required, default us-east-1) — selects the regional AWS Secrets Manager endpoint, secretsmanager.<region>.amazonaws.com, and is used in the AWS Signature V4 credential scope.

  • AWS Access Key ID (required) — the IAM access key ID used to authenticate to AWS.

  • AWS Secret Access Key (required) — the IAM secret access key used as the seed for the AWS4-HMAC-SHA256 signing key. Never sent on the wire.

  • AWS Session Token (optional) — included as the X-Amz-Security-Token header when using AWS STS temporary credentials. Leave blank for long-lived IAM user keys.

  • Credential ID (required) — the secret name or full ARN passed as SecretId in the GetSecretValue API call.

Data retrieved from AWS Secrets Manager at scan time

The AWS Secrets Manager integration retrieves a single secret per unique Credential ID per scan chunk. Each retrieved secret value is parsed as JSON; if the secret is plain text, the entire string is treated as the password. The integration extracts the following fields from the parsed secret value (when present):

  • username — the login name used to authenticate to the target. Overridden by the Username field of the credential when set.

  • password — the login password. May also carry an SSH private key — see the password vs. ssh_key note below.

  • ssh_key — an SSH private key (PEM-encoded). When present, it is used in place of password for SSH authentication.

  • passphrase — the passphrase that decrypts an encrypted SSH private key. Only consulted when an SSH key is supplied (either via the ssh_key field or via a password field that contains PEM key material).

  • domain — the Windows or Active Directory domain. Used only when Fetch Domain is enabled in the credential.

Note: password vs. ssh_key: If ssh_key is present in the secret, it always takes precedence and is used as the SSH private key. If ssh_key is absent but the password value contains PEM markers (the literal text -----BEGIN or PRIVATE KEY), the integration treats the password field as an SSH private key rather than as a password. In every other case, the password field is used as a plain password. The passphrase field is only applied when one of those two SSH-key paths is taken.

If privilege escalation is configured for an SSH credential, the integration retrieves a second secret (the Escalation Credential ID) and uses its password field as the sudo/escalation password.

API requests per target

The integration makes one POST to secretsmanager.<region>.amazonaws.com per unique secret per scan chunk. Results are cached for the duration of the chunk by the MD5 of the secret ID, so multiple targets that share a secret only require one API call. When privilege escalation uses a separate Escalation Credential ID, one additional secret retrieval is performed.

Credentialed scans

Credentialed scans allow the Tenable scanner to log in to the target system directly and perform a deeper assessment than is possible without credentials. This includes checking installed software versions, configuration settings, patch levels, and compliance status.

What the AWS Secrets Manager integration does not collect

This integration does not support the following Tenable credential types as an authentication method. For these types, you must use a different PAM integration or configure credentials within the scan policy:

  • F5 Networks

  • PAN-OS

  • SNMPv3

The integration does not perform dynamic scanning or auto-discovery. AWS Secrets Manager stores secrets only and does not expose target host names or IP addresses. Scan targets must be supplied through the normal target list or asset source.

Compliance audit credentials are not separately fetched by this integration; the integration returns a single login credential and that same credential is used for compliance checks when enabled in the scan template.

AWS Secrets Manager integration limitations

AWS Secrets Manager allows up to 10,000 API requests per second per AWS account, which is well above the request rate generated by Tenable scans. The integration further reduces request volume by caching each secret per scan chunk.

Each retrieved secret incurs the standard AWS Secrets Manager pricing. Refer to Amazon for current AWS pricing.