Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Strongbox: a secret manager for AWS

schibsted.github.io

Post reply on HN
Print view View original

1–10 of 58 posts

Re: Strongbox: a secret manager for AWS

#3

Post by auspex »

Hi, this really needs a REST API.

Most secrets are injected in real time at the startup of of a container. For tools like this or plugins in k8 / docker to access your store you should support this. It's really bad practice to create a hard dependency on your secrets store by using the Java sdk directly in your application. If that's not the intent definitely provide a Golang sdk for proper plugin integration.

Can you explain how secrets are injected now?

Re: Strongbox: a secret manager for AWS

#5

Post by stiankri »

auspex wrote: post #3

Hi, this really needs a REST API. Most secrets are injected in real time at the startup of of a container. For tools like this or plugins in k8 / docker to access your store you should support this. It's really bad practice to create a hard dependency on your secrets store by using the Java sdk directly in your application. If that's not the intent definitely provide a Golang sdk for proper plugin integration. Can yo…

Today people are using the SDK directly or injecting secrets via the CLI. Multi-language support and integration with e.g. Kubernetes is high on the wish list. The approach we are looking at for multi-language support is to drop the dependency on the AWS Encryption SDK. Creating a read-only SDK in other languages is then straight forward.

Re: Strongbox: a secret manager for AWS

#7

Post by bespoke_engnr »

Charging $1 per secret is interesting. I wonder if that will affect how people design their application.

We've had a pretty splendid experience with Vault so far, so I'm not exactly in the market for another solution, but this looks interesting.

I assume you started development on this because Vault et al didn't exist yet at the time? Or was there another driver?

Re: Strongbox: a secret manager for AWS

#8

Post by stiankri »

dotemacs wrote: post #6
stiankri wrote: post #2

I'm the creator of Strongbox. Feel free to ask me technical questions about the project.

Thanks, your project looks useful Here are some questions: Are you using Strongbox in production? The backup is mentioned, but how exactly do you backup? Thanks

The project has been used in production since the summer of 2016. It is being used by a number of teams, and has been contributed to by more than 20 developers (there is a CONTRIBUTORS file).

The backup will take the data stored in DynamoDB (or a file) and serialize to an encrypted file. It will not backup the KMS key, or IAM policies. Hence, it is useful to take snapshots of your state, but not a full disaster recovery.

You can take a backup by a click of a button in the GUI, or using the cli: `strongbox group backup --group team.project --dst-path my-file.backup`

Re: Strongbox: a secret manager for AWS

#10

Post by biochimia »

bespoke_engnr wrote: post #7

Charging $1 per secret is interesting. I wonder if that will affect how people design their application. We've had a pretty splendid experience with Vault so far, so I'm not exactly in the market for another solution, but this looks interesting. I assume you started development on this because Vault et al didn't exist yet at the time? Or was there another driver?

The charges are for the AWS services that Strongbox uses to implement its functionality. That's $1 per KMS key, which can be used to manage multiple secrets, plus the cost of the storage backend. In the most common setup, DynamoDB tables are being used for this.
Post reply on HN