Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Strongbox: a secret manager for AWS

schibsted.github.io

Post reply on HN
Print view View original

41–50 of 58 posts

Re: Strongbox: a secret manager for AWS

#41

Post by danenania »

manigandham wrote: post #34

There's also https://www.envkey.com/

Founder of EnvKey here--thanks for the mention. If anyone's interested, EnvKey takes more of a saas plug-and-play approach to managing secrets and configuration and isn't tied to AWS services (though it does run on AWS).

Tools like this one (Strongbox), Parameter Store, etc. are great when you know AWS well and prefer more of a DIY approach on the integration side. EnvKey is more of a "just works" solution for when you either don't have as much DevOps expertise or want to get a secure setup up and running asap so you can move on to the next thing.

EnvKey also helps on the configuration management side with juggling multiple environments (development, staging, production, etc.), inheritance between environments, and keeping developers in sync with each other.

Re: Strongbox: a secret manager for AWS

#42

Post by brazzledazzle »

sslalready wrote: post #25
joaofs wrote: post #9

why not just use parameter store? https://aws.amazon.com/ec2/systems-manager/parameter-store/ . Plus: don't use credentials directly, use the assume role feature.

Is it possible to use Parameter Store without configuring System Manager for the instances where it's used? I recently looked into SSM but was put off because the docs[1] suggested that you add the managed AmazonEC2RoleforSSM policy to instances, which among other things give them full read/write access to all S3 buckets. Edit: also discovered by others[2]. [1] http://docs.aws.amazon.com/systems-manager/latest/usergu…

Some of Amazon's IAM examples are very permissive. Perhaps it's because of the need for brevity but a link to additional examples that are more comprehensive and secure would be great.

Re: Strongbox: a secret manager for AWS

#43

Post by r1b »

Current parameter store user - one feature not mentioned in the comparison is the fact that accessing / updating a secret in parameter store will show up in Cloudtrail. Is there a similar audit trail in strongbox?

Re: Strongbox: a secret manager for AWS

#44

Post by ejcx »

joaofs wrote: post #9

why not just use parameter store? https://aws.amazon.com/ec2/systems-manager/parameter-store/ . Plus: don't use credentials directly, use the assume role feature.

We wrote about our use of parameter store extensively. We have been very happy with it:

https://segment.com/blog/the-right-way-to-manage-secrets/

I really think it's just an AWS account with credstash under the hood, that some Amazon engineers work on full time. Seems like a no-brainer to use imo, since it's very polished.

Re: Strongbox: a secret manager for AWS

#46

Post by rad_gruchalski »

stiankri wrote: post #23
rad_gruchalski wrote: post #19

Earlier quoted context omitted.

Sure, but what if the language I'm using is not high on your priority list? Isn't it easier to add a high level rest api?

That is certainly one approach we have looked at. The question then is where would you run the REST API? As a side car, as a separate service, e.g. using AWS API Gateway and Lambdas? If you look at the work required to write a simplified read-only client using the AWS SDK for KMS and DynamoDB, while perhaps a bit more work than integrating with a REST API, it is not that far off, which is why we are considering that…

All AWS SDKs use the underlying REST(ey) API. The SDKs are literally machine generated. I can download the WSDLs or take these files https://github.com/aws/aws-sdk-go/tree/master/models/apis and generate one myself.

Re: Strongbox: a secret manager for AWS

#47

Post by mikeokner »

The comparison with Vault is somewhat misleading.

- There are several free UIs available for Vault like https://github.com/djenriquez/vault-ui, they just aren't provided by Hashicorp

- I'm not sure what "file secrets" might refer to other than storing the contents of a file, for which Vault's CLI provides shortcuts.

- While Vault's generic k/v backend doesn't support purging expired values in order to avoid accidental data loss, there are plenty of other backends that integrate with AWS STS, Postgres, etc. to provide dynamic, short-lived credentials.

- I'm not sure how Vault doesn't support encrypted backups seeing as the data is already encrypted on disk. Take EBS snapshots or something.

- Versioning of secrets is a popular request and Hashicorp has some "vague plans" which is an improvement from "no plans." https://github.com/hashicorp/vault/issues/1364#issuecomment-...

Plus you get a full REST API, a ton of auth methods, granular access policies, etc.

Re: Strongbox: a secret manager for AWS

#48

Post by cyberferret »

manigandham wrote: post #34

There's also https://www.envkey.com/

Happy user of Envkey here. I was trying to get my head around AWS's secrets management, and even with useful blog posts from the likes of Segment.io etc., it was giving me a headache.

Envkey let me set up and deploy secrets management across 3 server groups (development/staging/production) for our web app in under 15 minutes. And I can add new developers and devops people to our app in seconds.

I normally don't like hijacking other people threads about their hard work like this, but I just thought this product should be mentioned as it was a real time saver and headache reducer for us. Very happy to see people like the developers of StrongBox trying to solve this issue and make secrets management easier. The more players in this space, the better, IMO.

Re: Strongbox: a secret manager for AWS

#49

Post by sslalready »

res0nat0r wrote: post #36
kompiuter wrote: post #30

Earlier quoted context omitted.

You're right. I've never even heard of ParameterStore before.

Exactly. I was wishing for an AWS based cli accessible credstore service for a while and didn't even know this existed until just the other week. One big problem with AWS and their incremental features / improvements is you never hear about much of it, or its buried in a post from Jeff's blog that you have to watch like a hawk to keep up with.

I can recommend subscribing to Most recent announcements from AWS[1] for keeping up. You'll get weekly summary emails with headlines, HN style. They link to articles here[2].

[1] https://aws.amazon.com/subscribe-to-aws-announcements/

[2] https://aws.amazon.com/about-aws/whats-new/2017/

Post reply on HN