The secret manager is sooo good at hiding things that the API or AWS CLI does not show you secrets scheduled for deletion... But you can cheat your way around this. The GOpher can discover the secret...
Update March 2023:
AWS Secrets Manager now supports listing secrets scheduled for deletion with a new request parameter, IncludePlannedDeletion.
Thanks to Simon Marty for pointing it out and updating my code!
When you delete a secret from AWS Secrets Manager, the standard
aws secretsmanager list-secrets
does not show these secrets.
Also, there is no parameter to show the deleted /schedules for deletion secrets.
In the AWS console, you have the option to show these secrets also:
Debugging the AWS console, you see that the console is cheating and using a parameter not defined in the API
Definition, see APIdoc.
So you have to change the content of the request to:
{
"MaxResults": 100,
"IncludeDeleted": true,
"SortOrder": "desc",
"Filters": []
}
Implement with GO SDK V2
In go the input parameter for the secretsmanager.ListSecrets are well-defined, so any attempt to add a field will go wrong.
But because of the GO middleware, you can manipulate requests at all stages.
See AWS GO SDK V2 Middleware for documentation.
The middleware has several steps:
| Stack Step | Description |
|---|---|
| Initialize | Prepares the input and sets any default parameters as needed. |
| Serialize | Serializes the input to a protocol format suitable for the target transport layer. |
| Build | Attach additional metadata to the serialised input, such as HTTP Content-Length. |
| Finalize | Final message preparation, including retries and authentication (SigV4 signing). |
| Deserialize | Deserialize responses from the protocol format into a structured type or error. |
The Build step seems fine for this.
So we append a function to the cfg with ApiOptions:
cfg, err := config.LoadDefaultConfig(context.TODO())
if err != nil {
panic("configuration error, " + err.Error())
}
cfg.APIOptions = append(cf.APIOptions, func(stack *middleware. Stack) error {
// Attach the custom middleware to the beginning of the Build step
return stack.Build.Add(secret parameter, middleware.Before)
})
client = secretsmanager.NewFromConfig(cfg)
```
The function `secretsmanager` now replaces the JSON content of the request to the API with the JSON data, which the console uses.
## Run
Create a secret "deleteme" in the AWS console and delete it again. The AWS CLI will show you an empty list:
```bash
aws secretsmanager list-secrets
{
"SecretList": []
}
```
With this[this](https://github.com/megaproaktiv/listdeletedsecrets) programm:
```bash
go run main.go
```
You get the Output:
```bash
Results
=======
Secret: deleteme / deleted on 2022-11-23 12:23:58.374 +0000 UTC
```
## Show details
Now you may describe the secret:
```bash
aws secretsmanager describe-secret --secret-id deleteme
```
## Really delete
And you can delete it for good - use it at your own risk!
```bash
aws secretsmanager delete-secret --secret-id deleteme --force-delete-without-recovery
```
## Source
See [github](https://github.com/megaproaktiv/listdeletedsecrets) for the source code and the releases to download an executable : [Release](https://github.com/megaproaktiv/listdeletedsecrets/releases/tag/v0.1.1)
Top comments (0)