Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

AWS Secrets Manager – Store, Distribute, and Rotate Credentials Securely

aws.amazon.com

Post reply on HN
Print view View original

31–40 of 137 posts

Re: AWS Secrets Manager – Store, Distribute, and Rotate Credentials Securely

#31

Post by scrollaway »

januszeal wrote: post #29
scrollaway wrote: post #18

First reaction: Holy crap! They finally turned ParameterStore into a proper product! Second reaction: Holy shit that's expensive [for what it does]. ParameterStore is free (minus the KMS component). The only value-add is secret rotation and that's not something that most of the time makes sense to use. [Edit: I'm not advocating for no rotation; see replies] Edit: Had more time to think about it. Someone enlighten me:…

>The only value-add is secret rotation and that's not something that most of the time makes sense to use. This attitude is why company after company keeps leaking customer data.

This hasty drawing of conclusions from a post that wasn't suggesting you shouldn't rotate secrets is why populist after populist keeps getting elected.

Re: AWS Secrets Manager – Store, Distribute, and Rotate Credentials Securely

#32

Post by tptacek »

toomuchtodo wrote: post #25
scrollaway wrote: post #18

First reaction: Holy crap! They finally turned ParameterStore into a proper product! Second reaction: Holy shit that's expensive [for what it does]. ParameterStore is free (minus the KMS component). The only value-add is secret rotation and that's not something that most of the time makes sense to use. [Edit: I'm not advocating for no rotation; see replies] Edit: Had more time to think about it. Someone enlighten me:…

> The only value-add is secret rotation and that's not something that most of the time makes sense to use. From a security perspective, you should be rotating secrets somewhere between annually and every 90 days, depending on your business/security/compliance requirements and the nature of the data secured by the secret.

It depends on the secret and the degree to which the secret is exposed. SSH creds should get rotated constantly; a one-hour SSH login cred is a significant exposure. But an API secret that is kept in Parameter Store and not exposed to developers doesn't really benefit from rotation every 3 months in proportion to the amount of mechanism required to do that.

Re: AWS Secrets Manager – Store, Distribute, and Rotate Credentials Securely

#33

Post by [deleted] »

tptacek wrote: post #32
toomuchtodo wrote: post #25

Earlier quoted context omitted.

> The only value-add is secret rotation and that's not something that most of the time makes sense to use. From a security perspective, you should be rotating secrets somewhere between annually and every 90 days, depending on your business/security/compliance requirements and the nature of the data secured by the secret.

It depends on the secret and the degree to which the secret is exposed. SSH creds should get rotated constantly ; a one-hour SSH login cred is a significant exposure. But an API secret that is kept in Parameter Store and not exposed to developers doesn't really benefit from rotation every 3 months in proportion to the amount of mechanism required to do that.

[deleted]

Re: AWS Secrets Manager – Store, Distribute, and Rotate Credentials Securely

#34

Post by apawloski »

tptacek wrote: post #32
toomuchtodo wrote: post #25

Earlier quoted context omitted.

> The only value-add is secret rotation and that's not something that most of the time makes sense to use. From a security perspective, you should be rotating secrets somewhere between annually and every 90 days, depending on your business/security/compliance requirements and the nature of the data secured by the secret.

It depends on the secret and the degree to which the secret is exposed. SSH creds should get rotated constantly ; a one-hour SSH login cred is a significant exposure. But an API secret that is kept in Parameter Store and not exposed to developers doesn't really benefit from rotation every 3 months in proportion to the amount of mechanism required to do that.

How are you managing your SSH keys to make <1HR rotation feasible?

Re: AWS Secrets Manager – Store, Distribute, and Rotate Credentials Securely

#35

Post by tptacek »

apawloski wrote: post #34
tptacek wrote: post #32

Earlier quoted context omitted.

It depends on the secret and the degree to which the secret is exposed. SSH creds should get rotated constantly ; a one-hour SSH login cred is a significant exposure. But an API secret that is kept in Parameter Store and not exposed to developers doesn't really benefit from rotation every 3 months in proportion to the amount of mechanism required to do that.

How are you managing your SSH keys to make <1HR rotation feasible?

With an SSH CA.

Re: AWS Secrets Manager – Store, Distribute, and Rotate Credentials Securely

#36

Post by [deleted] »

tptacek wrote: post #32
toomuchtodo wrote: post #25

Earlier quoted context omitted.

> The only value-add is secret rotation and that's not something that most of the time makes sense to use. From a security perspective, you should be rotating secrets somewhere between annually and every 90 days, depending on your business/security/compliance requirements and the nature of the data secured by the secret.

It depends on the secret and the degree to which the secret is exposed. SSH creds should get rotated constantly ; a one-hour SSH login cred is a significant exposure. But an API secret that is kept in Parameter Store and not exposed to developers doesn't really benefit from rotation every 3 months in proportion to the amount of mechanism required to do that.

[deleted]

Re: AWS Secrets Manager – Store, Distribute, and Rotate Credentials Securely

#37

Post by Dunedan »

scrollaway wrote: post #18

First reaction: Holy crap! They finally turned ParameterStore into a proper product! Second reaction: Holy shit that's expensive [for what it does]. ParameterStore is free (minus the KMS component). The only value-add is secret rotation and that's not something that most of the time makes sense to use. [Edit: I'm not advocating for no rotation; see replies] Edit: Had more time to think about it. Someone enlighten me:…

My biggest criticism of Parameter Store is actually that it's free. Let me explain:

Because it's free they limit the requests per seconds you can make to the Parameter Store. That's especially noticeable when doing requests for all parameters of a given path, as the limit is way lower there than for requesting (a bunch of) individual parameters. In the past that caused serious problems for us when using Parameter Store for AWS Lambda functions during a deploy of new versions of functions, as suddenly there was a spike in the number of requests to Parameter Store as all AWS Lambda containers got replaced.

They of course set such limits because it's free, so I'd gladly pay for getting increased limits.

Re: AWS Secrets Manager – Store, Distribute, and Rotate Credentials Securely

#38

Post by eropple »

0xCMP wrote: post #17
kondro wrote: post #12

At $0.40 per secret per month and $0.05 per 10,000 requests this is much more expensive than the practically free SSM Parameter Store product, even if you factor in the auto-rotating bits.

It'd be cheaper than running Vault with a backing Consul cluster which also provides rotation and other features. There is a point where Vault is more cost effective, but I believe it'd require a ton of requests and secrets to justify min 6 machines of at least t2.micro that also need to managed and secured.

It's definitely not cheaper than KMS and DynamoDB via Credstash, though.

Re: AWS Secrets Manager – Store, Distribute, and Rotate Credentials Securely

#39

Post by qxi »

whateveracct wrote: post #7

This looks like an AWS equivalent of the Amazon-internal secret management tool called Odin. Which is very nice because Odin was pretty much universally loved from what I saw.

Odin works really well but but only because it integrates so tightly with with the rest of the internal tooling. Without Apollo (another internal tool) to manage and orchestrate the deployment of packages that need Odin's secrets, it's a lot clumsier to use.

Re: AWS Secrets Manager – Store, Distribute, and Rotate Credentials Securely

#40

Post by scrollaway »

Dunedan wrote: post #37
scrollaway wrote: post #18

First reaction: Holy crap! They finally turned ParameterStore into a proper product! Second reaction: Holy shit that's expensive [for what it does]. ParameterStore is free (minus the KMS component). The only value-add is secret rotation and that's not something that most of the time makes sense to use. [Edit: I'm not advocating for no rotation; see replies] Edit: Had more time to think about it. Someone enlighten me:…

My biggest criticism of Parameter Store is actually that it's free. Let me explain: Because it's free they limit the requests per seconds you can make to the Parameter Store. That's especially noticeable when doing requests for all parameters of a given path, as the limit is way lower there than for requesting (a bunch of) individual parameters. In the past that caused serious problems for us when using Parameter Sto…

Oh yeah, I agree - and I have no beef with the per-request pricing. It's the per-secret pricing that's weird. If I understand this announcement correctly, you're still paying for KMS separately as well, so that's not where the price spike comes from...
Post reply on HN