Earlier quoted context omitted.
After leaving Amazon you really go on to understand how good the internal tools are at Amazon and how they probably have the best tools in the industry.
Except SIM.
+1 Hahaha! This made my day.
AWS Secrets Manager – Store, Distribute, and Rotate Credentials Securely
111–120 of 137 posts
Re: AWS Secrets Manager – Store, Distribute, and Rotate Credentials Securely
#112Earlier quoted context omitted.
After leaving Amazon you really go on to understand how good the internal tools are at Amazon and how they probably have the best tools in the industry.
Brazil + Apollo + Pipelines. I left (and later boomeranged) and was surprised that the outside world hadn't solved these problems nearly as well. Don't get me wrong, Brazil and Apollo probably are ready for a rethink and rewrite, but they do a great job.
if you went to another bloated enterprise company, that wouldn't be surprising. If you went to a high-profile consulting company and had that experience, I'd be shocked.
Re: AWS Secrets Manager – Store, Distribute, and Rotate Credentials Securely
#113Besides the secrets rotation how is this different from EC2 Parameter Store? I’m genuinely curious and will move away from parameter store if this provides some benefits.
$$$
Re: AWS Secrets Manager – Store, Distribute, and Rotate Credentials Securely
#114Earlier quoted context omitted.
Surprised at all the folks openly discussing internal tooling.
There are a specific set of internal things at Amazon that public discussion of would be detrimental to your career. Saying what you think of Odin isn't quite the same as mentioning the release date of the next Kindle.
Of course, and I don't think anyone would or should get reprimanded for it. That said, I still think it's poor form and should be avoided unless absolutely necessary.
Re: AWS Secrets Manager – Store, Distribute, and Rotate Credentials Securely
#115Earlier quoted context omitted.
Depends on how many secrets you're storing. You can also back Vault with something other than Consul. You can back it with DynamoDB, which would be much cheaper than managing your own Consul cluster. You can even back it with S3, which would be dirt cheap (cost of the vault instance + a few cents for storage).
I wasn't aware you could use Dynamo or S3, that's pretty interesting
[deleted]
Re: AWS Secrets Manager – Store, Distribute, and Rotate Credentials Securely
#116Re: AWS Secrets Manager – Store, Distribute, and Rotate Credentials Securely
#117At $0.40 per secret it would have been nice if they had a 5 secret free tier. That would get smaller users to start using it instead of parameter store and eventually realize the value of automated and audited secret rotation
Yeah I'm thinking about starting to use it for personal projects but don't want to bother with these 2 dollar bills. I'm pretty sure they can benefit from me playing with it first and then advocating for it at work
Re: AWS Secrets Manager – Store, Distribute, and Rotate Credentials Securely
#118Earlier quoted context omitted.
With an SSH CA.
Is there one of those you’d recommend?
Re: AWS Secrets Manager – Store, Distribute, and Rotate Credentials Securely
#119First reaction: Holy crap! They finally turned ParameterStore into a proper product! Second reaction: Holy shit that's expensive [for what it does]. ParameterStore is free (minus the KMS component). The only value-add is secret rotation and that's not something that most of the time makes sense to use. [Edit: I'm not advocating for no rotation; see replies] Edit: Had more time to think about it. Someone enlighten me:…
After Amazon EC2 Systems Manager Parameter Store got some much needed love last year (adding KMS encryption and versioning), I wrote a small utility for populating environment variables using a specific Parameter Store prefix: https://github.com/nlindblad/confidential
It can either write the environment variables out to a Docker compatible environment file or it can be used as a wrapper to run any executable/script with the environment pre-populated. The README contains various examples of those use cases.
The primary motivation was to have proper secrets management for my hobby projects that didn't rely on Ansible Vault, configuration files in S3 or having to use the AWS SDK in each project.
Re: AWS Secrets Manager – Store, Distribute, and Rotate Credentials Securely
#120Earlier quoted context omitted.
The big missing piece is roles. No service uses a root access key directly. Instead, there's a webserver role with access to a relevant secrets group but no access to data warehouse secrets, for example. Access keys can be provisioned and downloaded straight onto the box from the service. Sure, a compromise is bad, but only exposes the secrets that would be available on the pwned box regardless.
OK, so "root" wasn't really the right term. I get an X credential so I can be an X, and nobody needs to worry that I also got enough to be any part of a Y. Thanks.
This sort of model also fits nicely with the AWS ecosystem. EC2 instances (virtual machines) can be given an IAM Role when they boot-up. An IAM Role is essentially an automatically generated access key which is unique to that EC2 instance, and has pre-determined permissions.
So in other words – a unique key is generated every time a virtual machine is created. It's fully automated, never shared between instances, and never needs to be handled manually. That key will give the virtual machine permission to access other AWS services, in this case the AWS Secrets Manager.
So as long as you're using EC2 instances, you won't need to worry about securely passing a 'master password' to your VMs in order for them to access secrets.