Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

AWS Secrets Manager – Store, Distribute, and Rotate Credentials Securely

aws.amazon.com

Post reply on HN
Print view View original

21–30 of 137 posts

Re: AWS Secrets Manager – Store, Distribute, and Rotate Credentials Securely

#21

Post by scrollaway »

neuronexmachina wrote: post #5
epberry wrote: post #3

Besides the secrets rotation how is this different from EC2 Parameter Store? I’m genuinely curious and will move away from parameter store if this provides some benefits.

Skimming the blog post, the main difference seems that it allows you to basically store a dict of key/value pairs for each secret. So for example, you could store all the user/pass/host/port for a DB connection as a secret. If I recall correctly, Parameter Store could only store a single SecureString for each secret.

ParameterStore lets you store String, StringList or SecureString. But there's no limit to SecureString.

A SecureString can be `postgres://admin:hunter2@localhost:5432/db`. It can also be `{"username": "admin", "password": "hunter2", "host": "localhost", "port": "5432"}`.

Re: AWS Secrets Manager – Store, Distribute, and Rotate Credentials Securely

#22

Post by scrollaway »

o_____________o wrote: post #19
kondro wrote: post #12

At $0.40 per secret per month and $0.05 per 10,000 requests this is much more expensive than the practically free SSM Parameter Store product, even if you factor in the auto-rotating bits.

Agree the pricing is way off, but at least you can use an object/table inside a secret to serve as a group of secrets. eg, not just key:"value", but key:{key:"value", key:"value", ...}

Nothing stops you from storing JSON in ParameterStore.

Re: AWS Secrets Manager – Store, Distribute, and Rotate Credentials Securely

#23

Post by xkjkls »

bpicolo wrote: post #15
kondro wrote: post #12

At $0.40 per secret per month and $0.05 per 10,000 requests this is much more expensive than the practically free SSM Parameter Store product, even if you factor in the auto-rotating bits.

Yeah, I'm surprised they charge per secret. I guess it's a blip when you have big aws spend

Yeah, I don't think too many people have tens of thousands of secrets, generally. The addition of key rotation is a great benefit.

Re: AWS Secrets Manager – Store, Distribute, and Rotate Credentials Securely

#25

Post by toomuchtodo »

scrollaway wrote: post #18

First reaction: Holy crap! They finally turned ParameterStore into a proper product! Second reaction: Holy shit that's expensive [for what it does]. ParameterStore is free (minus the KMS component). The only value-add is secret rotation and that's not something that most of the time makes sense to use. [Edit: I'm not advocating for no rotation; see replies] Edit: Had more time to think about it. Someone enlighten me:…

> The only value-add is secret rotation and that's not something that most of the time makes sense to use.

From a security perspective, you should be rotating secrets somewhere between annually and every 90 days, depending on your business/security/compliance requirements and the nature of the data secured by the secret.

Re: AWS Secrets Manager – Store, Distribute, and Rotate Credentials Securely

#26

Post by cavisne »

chatmasta wrote: post #6

How is this different than KMS? “Key Management Service” is practically synonymous with the name of this new product, so how exactly do the two differ/interact?

A key difference is in kms you never know the actual secret (kms stores this on your behalf) . This is for use cases where you need the secret in application code, like db creds.

Looks like a cool product I noticed they dont include a revoke workflow though, the trickiest bit of key rotation

Re: AWS Secrets Manager – Store, Distribute, and Rotate Credentials Securely

#27

Post by scrollaway »

toomuchtodo wrote: post #25
scrollaway wrote: post #18

First reaction: Holy crap! They finally turned ParameterStore into a proper product! Second reaction: Holy shit that's expensive [for what it does]. ParameterStore is free (minus the KMS component). The only value-add is secret rotation and that's not something that most of the time makes sense to use. [Edit: I'm not advocating for no rotation; see replies] Edit: Had more time to think about it. Someone enlighten me:…

> The only value-add is secret rotation and that's not something that most of the time makes sense to use. From a security perspective, you should be rotating secrets somewhere between annually and every 90 days, depending on your business/security/compliance requirements and the nature of the data secured by the secret.

You're not necessarily your own source of secret (and even when you are, you don't necessarily have the option to use AWS-sourced rotation).

In other words, yes, you should be rotating what you can rotate, but this doesn't always help. Furthermore, it doesn't justify the pricing. It would make sense if this were, say, "Hey, you can now auto-rotate SSM-PS secrets for an extra $0.40/secret".

Right now it just seems weird.

[Edit: I just saw the custom rotation bit of the article. Cool; but if you're at the point of setting up lambdas for the rotation, you might as well cron a lambda on top of ParameterStore...]

Re: AWS Secrets Manager – Store, Distribute, and Rotate Credentials Securely

#28

Post by [deleted] »

scrollaway wrote: post #27
toomuchtodo wrote: post #25

Earlier quoted context omitted.

> The only value-add is secret rotation and that's not something that most of the time makes sense to use. From a security perspective, you should be rotating secrets somewhere between annually and every 90 days, depending on your business/security/compliance requirements and the nature of the data secured by the secret.

You're not necessarily your own source of secret (and even when you are, you don't necessarily have the option to use AWS-sourced rotation). In other words, yes, you should be rotating what you can rotate, but this doesn't always help. Furthermore, it doesn't justify the pricing. It would make sense if this were, say, "Hey, you can now auto-rotate SSM-PS secrets for an extra $0.40/secret". Right now it just seems wei…

[deleted]

Re: AWS Secrets Manager – Store, Distribute, and Rotate Credentials Securely

#29

Post by januszeal »

scrollaway wrote: post #18

First reaction: Holy crap! They finally turned ParameterStore into a proper product! Second reaction: Holy shit that's expensive [for what it does]. ParameterStore is free (minus the KMS component). The only value-add is secret rotation and that's not something that most of the time makes sense to use. [Edit: I'm not advocating for no rotation; see replies] Edit: Had more time to think about it. Someone enlighten me:…

>The only value-add is secret rotation and that's not something that most of the time makes sense to use.

This attitude is why company after company keeps leaking customer data.

Re: AWS Secrets Manager – Store, Distribute, and Rotate Credentials Securely

#30

Post by Florin_Andrei »

scrollaway wrote: post #18

First reaction: Holy crap! They finally turned ParameterStore into a proper product! Second reaction: Holy shit that's expensive [for what it does]. ParameterStore is free (minus the KMS component). The only value-add is secret rotation and that's not something that most of the time makes sense to use. [Edit: I'm not advocating for no rotation; see replies] Edit: Had more time to think about it. Someone enlighten me:…

What's the backend? If it's HSM, that would explain the steep price (sort of).
Post reply on HN