Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Strongbox: a secret manager for AWS

schibsted.github.io

Post reply on HN
Print view View original

11–20 of 58 posts

Re: Strongbox: a secret manager for AWS

#11

Post by biochimia »

joaofs wrote: post #9

why not just use parameter store? https://aws.amazon.com/ec2/systems-manager/parameter-store/ . Plus: don't use credentials directly, use the assume role feature.

The parameter store was not available at the time Strongbox was designed and developed. The Strongbox project page has a nice matrix comparing how Strongbox stacks up against Parameter Store.

In terms of not using credentials directly, relying on AWS KMS for encryption keys, and the use of IAM policies to control access to secrets, Strongbox and AWS Parameter Store share a similar design.

Re: Strongbox: a secret manager for AWS

#12

Post by stiankri »

bespoke_engnr wrote: post #7

Charging $1 per secret is interesting. I wonder if that will affect how people design their application. We've had a pretty splendid experience with Vault so far, so I'm not exactly in the market for another solution, but this looks interesting. I assume you started development on this because Vault et al didn't exist yet at the time? Or was there another driver?

Strongbox was designed prior to AWS Parameter Store, and took its inspiration from projects like Fugue CredStash and similar AWS KMS based projects. While there are certainly pros and cons with the different approaches, which you can see in the linked comparison table, I think one of Strongbox' strengths is that it is easy to set up, and you get a lot of convenience functionality related to secrets management. Not having to maintain running services, and natural compartmentalization using both AWS IAM and AWS accounts was two of the drivers.

$1 per group of secrets, e.g. a service. In many cases I think this is fine, but it is certainly not a strength.

Re: Strongbox: a secret manager for AWS

#13

Post by jwineinger »

joaofs wrote: post #9

why not just use parameter store? https://aws.amazon.com/ec2/systems-manager/parameter-store/ . Plus: don't use credentials directly, use the assume role feature.

This. We used credstash for a while (same concept as this, at a glance) and now we're running for parameter store

Re: Strongbox: a secret manager for AWS

#15

Post by stiankri »

joaofs wrote: post #9

why not just use parameter store? https://aws.amazon.com/ec2/systems-manager/parameter-store/ . Plus: don't use credentials directly, use the assume role feature.

AWS Parameter Store certainly has merit. As you can see from the comparison table there are certain functionality that is supported by Strongbox which AWS Parameter Store does not currently offer, like larger secrets, more secrets etc.

You can use the assume role functionality with Strongbox. The examples don't do this for simplicity.

Re: Strongbox: a secret manager for AWS

#16

Post by Lunatic666 »

stiankri wrote: post #2

I'm the creator of Strongbox. Feel free to ask me technical questions about the project.

Including the Spring-Cloud config server would have been interesting , because it has all the mentioned features, but is running on top of git. If you are on AWS, you can use one if the free CodeCommit repos.

The cool thing is obviously the spring integration, which pulls the secrets on app startup and overwrites or augments the values in the application.(properties|yml)

It can also run kind of serverless by embedding it in your app.

Re: Strongbox: a secret manager for AWS

#17

Post by emil_va »

Lunatic666 wrote: post #16
stiankri wrote: post #2

I'm the creator of Strongbox. Feel free to ask me technical questions about the project.

Including the Spring-Cloud config server would have been interesting , because it has all the mentioned features, but is running on top of git. If you are on AWS, you can use one if the free CodeCommit repos. The cool thing is obviously the spring integration, which pulls the secrets on app startup and overwrites or augments the values in the application.(properties|yml) It can also run kind of serverless by embeddin…

Yeah, we have the same features with the strongbox-spring-boot-starter, it injects all secrets as properties on application bootstrap: https://github.com/schibsted/strongbox/blob/master/spring-bo...

Re: Strongbox: a secret manager for AWS

#19

Post by rad_gruchalski »

stiankri wrote: post #5
auspex wrote: post #3

Hi, this really needs a REST API. Most secrets are injected in real time at the startup of of a container. For tools like this or plugins in k8 / docker to access your store you should support this. It's really bad practice to create a hard dependency on your secrets store by using the Java sdk directly in your application. If that's not the intent definitely provide a Golang sdk for proper plugin integration. Can yo…

Today people are using the SDK directly or injecting secrets via the CLI. Multi-language support and integration with e.g. Kubernetes is high on the wish list. The approach we are looking at for multi-language support is to drop the dependency on the AWS Encryption SDK. Creating a read-only SDK in other languages is then straight forward.

Sure, but what if the language I'm using is not high on your priority list? Isn't it easier to add a high level rest api?

Re: Strongbox: a secret manager for AWS

#20

Post by rad_gruchalski »

joaofs wrote: post #9

why not just use parameter store? https://aws.amazon.com/ec2/systems-manager/parameter-store/ . Plus: don't use credentials directly, use the assume role feature.

Yup, Strongbox has a dependency on DynamoDB so one may as well research the "native AWS" approach: https://aws.amazon.com/blogs/compute/managing-secrets-for-am... The nice thing about doing it the way described in the linked article, is that it composes really well with IAM. VMs, ECS tasks, Lambda functions and so on.
Post reply on HN