Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Strongbox: a secret manager for AWS

schibsted.github.io

Post reply on HN
Print view View original

21–30 of 58 posts

Re: Strongbox: a secret manager for AWS

#21

Post by stiankri »

0xmohit wrote: post #18

How does SecretBox compare with Vault [0] or BlackBox [1]? [0] https://github.com/hashicorp/vault [1] https://github.com/stackexchange/blackbox

[1] Please follow the link to see a comparison table with Hashicorp Vault and AWS Parameter Store: https://schibsted.github.io/strongbox/ [2] One of the fundamental differences between BlackBox and Strongbox is that BlackBox is based on GPG, while Strongbox is based on AWS KMS for encryption. Also BlackBox stores secrets in VCS repositories, while Strongbox primarily use AWS DynamoDB (while files are also supported).

Re: Strongbox: a secret manager for AWS

#23

Post by stiankri »

rad_gruchalski wrote: post #19
stiankri wrote: post #5

Earlier quoted context omitted.

Today people are using the SDK directly or injecting secrets via the CLI. Multi-language support and integration with e.g. Kubernetes is high on the wish list. The approach we are looking at for multi-language support is to drop the dependency on the AWS Encryption SDK. Creating a read-only SDK in other languages is then straight forward.

Sure, but what if the language I'm using is not high on your priority list? Isn't it easier to add a high level rest api?

That is certainly one approach we have looked at. The question then is where would you run the REST API? As a side car, as a separate service, e.g. using AWS API Gateway and Lambdas?

If you look at the work required to write a simplified read-only client using the AWS SDK for KMS and DynamoDB, while perhaps a bit more work than integrating with a REST API, it is not that far off, which is why we are considering that approach. That would of course not help if you are using a language that does not have an AWS SDK.

Re: Strongbox: a secret manager for AWS

#24

Post by scrollaway »

joaofs wrote: post #9

why not just use parameter store? https://aws.amazon.com/ec2/systems-manager/parameter-store/ . Plus: don't use credentials directly, use the assume role feature.

I don't understand why so few people talk about ParameterStore. It's a fantastic tool, and AWS does such a terrible job of advertising it.. hidden under SSM, an offering non-enterprise users probably don't care about, and giving the wrong impression that it's only for EC2.

ParameterStore should be part of KMS instead I think.

Re: Strongbox: a secret manager for AWS

#25

Post by sslalready »

joaofs wrote: post #9

why not just use parameter store? https://aws.amazon.com/ec2/systems-manager/parameter-store/ . Plus: don't use credentials directly, use the assume role feature.

Is it possible to use Parameter Store without configuring System Manager for the instances where it's used?

I recently looked into SSM but was put off because the docs[1] suggested that you add the managed AmazonEC2RoleforSSM policy to instances, which among other things give them full read/write access to all S3 buckets. Edit: also discovered by others[2].

[1] http://docs.aws.amazon.com/systems-manager/latest/userguide/...

[2] http://www.daemonology.net/blog/2016-10-09-EC2s-most-dangero...

Re: Strongbox: a secret manager for AWS

#26

Post by g09980 »

sslalready wrote: post #25
joaofs wrote: post #9

why not just use parameter store? https://aws.amazon.com/ec2/systems-manager/parameter-store/ . Plus: don't use credentials directly, use the assume role feature.

Is it possible to use Parameter Store without configuring System Manager for the instances where it's used? I recently looked into SSM but was put off because the docs[1] suggested that you add the managed AmazonEC2RoleforSSM policy to instances, which among other things give them full read/write access to all S3 buckets. Edit: also discovered by others[2]. [1] http://docs.aws.amazon.com/systems-manager/latest/usergu…

Works for me with instances having AmazonSSMReadOnlyAccess.

Re: Strongbox: a secret manager for AWS

#27

Post by joaofs »

sslalready wrote: post #25
joaofs wrote: post #9

why not just use parameter store? https://aws.amazon.com/ec2/systems-manager/parameter-store/ . Plus: don't use credentials directly, use the assume role feature.

Is it possible to use Parameter Store without configuring System Manager for the instances where it's used? I recently looked into SSM but was put off because the docs[1] suggested that you add the managed AmazonEC2RoleforSSM policy to instances, which among other things give them full read/write access to all S3 buckets. Edit: also discovered by others[2]. [1] http://docs.aws.amazon.com/systems-manager/latest/usergu…

Yes using AllowReadingSSMParameters and eventually the KMS key to encrypt/decrypt the parameter

Re: Strongbox: a secret manager for AWS

#28

Post by otterley »

ejcx wrote: post #14

If you're all in on AWS, just use parameter store. This scheme is just CredStash, and so is parameter store under the hood.

Even if you're not all-in on AWS, you can use Parameter Store for a trivial sum. The latency might be a bit higher, but in most cases it shouldn't matter since secrets usually have a nonzero TTL associated with them.

Re: Strongbox: a secret manager for AWS

#29

Post by otterley »

sslalready wrote: post #25
joaofs wrote: post #9

why not just use parameter store? https://aws.amazon.com/ec2/systems-manager/parameter-store/ . Plus: don't use credentials directly, use the assume role feature.

Is it possible to use Parameter Store without configuring System Manager for the instances where it's used? I recently looked into SSM but was put off because the docs[1] suggested that you add the managed AmazonEC2RoleforSSM policy to instances, which among other things give them full read/write access to all S3 buckets. Edit: also discovered by others[2]. [1] http://docs.aws.amazon.com/systems-manager/latest/usergu…

Yes, you can - it has a separate API with its own separate permissions. There's no need to use the full SSM to take advantage of Parameter Store.

Re: Strongbox: a secret manager for AWS

#30

Post by kompiuter »

scrollaway wrote: post #24
joaofs wrote: post #9

why not just use parameter store? https://aws.amazon.com/ec2/systems-manager/parameter-store/ . Plus: don't use credentials directly, use the assume role feature.

I don't understand why so few people talk about ParameterStore. It's a fantastic tool, and AWS does such a terrible job of advertising it.. hidden under SSM, an offering non-enterprise users probably don't care about, and giving the wrong impression that it's only for EC2. ParameterStore should be part of KMS instead I think.

You're right. I've never even heard of ParameterStore before.
Post reply on HN