Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

AWS Secrets Manager – Store, Distribute, and Rotate Credentials Securely

aws.amazon.com

Post reply on HN
Print view View original

41–50 of 137 posts

Re: AWS Secrets Manager – Store, Distribute, and Rotate Credentials Securely

#41

Post by Johnny555 »

scrollaway wrote: post #31
januszeal wrote: post #29

Earlier quoted context omitted.

>The only value-add is secret rotation and that's not something that most of the time makes sense to use. This attitude is why company after company keeps leaking customer data.

This hasty drawing of conclusions from a post that wasn't suggesting you shouldn't rotate secrets is why populist after populist keeps getting elected.

Is it really a "hasty drawing of conclusions" when it's based on a simple reading of what was written?

[secret rotation,] that's not something that most of the time makes sense to use.

Re: AWS Secrets Manager – Store, Distribute, and Rotate Credentials Securely

#42

Post by ryanianian »

whateveracct wrote: post #7

This looks like an AWS equivalent of the Amazon-internal secret management tool called Odin. Which is very nice because Odin was pretty much universally loved from what I saw.

There's still a bootstrap issue with AWS Secrets Manager - you have to set up enough tooling to be able to call the API.

The killer-app of odin imho was/is the on-machine http server that let all manner of applications very easily get credentials.

You could just do something like

  MY_API_KEY="$(curl http://localhost:5000?key=my-api)"
and boom your shell script or whatever was very easily using secrets.

The fact that Amazon systems bootstrapped EC2 instances meant they could easily enable this org-wide. The odin back-end then owned all the lifecycles around those secrets including what kinds of hosts they would go to, if/how they would rotate, etc etc. It has its annoyances including the fact you have to use http to localhost which can get saturated if you're not doing things right, but overall it really made secrets-management a non-issue.

Re: AWS Secrets Manager – Store, Distribute, and Rotate Credentials Securely

#43

Post by scrollaway »

Johnny555 wrote: post #41
scrollaway wrote: post #31

Earlier quoted context omitted.

This hasty drawing of conclusions from a post that wasn't suggesting you shouldn't rotate secrets is why populist after populist keeps getting elected.

Is it really a "hasty drawing of conclusions" when it's based on a simple reading of what was written? [secret rotation,] that's not something that most of the time makes sense to use.

I just had a quick glance at my own app. The majority of the secrets in it are generated outside of AWS and (unless I'm misunderstanding the announcement) can't be rotated by this service without custom logic to rotate them; at which point, as I said in a separate post, I might as well write that custom logic on top of ParameterStore and cron it.

Re: AWS Secrets Manager – Store, Distribute, and Rotate Credentials Securely

#44

Post by JoachimSchipper »

tptacek wrote: post #32
toomuchtodo wrote: post #25

Earlier quoted context omitted.

> The only value-add is secret rotation and that's not something that most of the time makes sense to use. From a security perspective, you should be rotating secrets somewhere between annually and every 90 days, depending on your business/security/compliance requirements and the nature of the data secured by the secret.

It depends on the secret and the degree to which the secret is exposed. SSH creds should get rotated constantly ; a one-hour SSH login cred is a significant exposure. But an API secret that is kept in Parameter Store and not exposed to developers doesn't really benefit from rotation every 3 months in proportion to the amount of mechanism required to do that.

What are you assuming about exposure? If a SSH key lives on a well-secured workstation or bastion host (and you ideally don't agent-forward it to insecure hosts), rotating that key once per hour doesn't seem a top priority to me? E.g. a sudo password is (lower-impact, but) more likely to get exposed to compromised hosts?

("Well-secured workstation" is arguably an oxymoron, of course...)

Re: AWS Secrets Manager – Store, Distribute, and Rotate Credentials Securely

#45

Post by ronnier »

whateveracct wrote: post #7

This looks like an AWS equivalent of the Amazon-internal secret management tool called Odin. Which is very nice because Odin was pretty much universally loved from what I saw.

After leaving Amazon you really go on to understand how good the internal tools are at Amazon and how they probably have the best tools in the industry.

Re: AWS Secrets Manager – Store, Distribute, and Rotate Credentials Securely

#46

Post by donavanm »

scrollaway wrote: post #18

First reaction: Holy crap! They finally turned ParameterStore into a proper product! Second reaction: Holy shit that's expensive [for what it does]. ParameterStore is free (minus the KMS component). The only value-add is secret rotation and that's not something that most of the time makes sense to use. [Edit: I'm not advocating for no rotation; see replies] Edit: Had more time to think about it. Someone enlighten me:…

Wrt rotation theres also a cultural component of it. Systems grow in complexity and importance. Forcing periodic rotation, With corresponding automagic client support, ensures thats its even possible when you need it. Compare STS tokens to IAM credentials.

Re: AWS Secrets Manager – Store, Distribute, and Rotate Credentials Securely

#48

Post by neuronexmachina »

scrollaway wrote: post #21
neuronexmachina wrote: post #5

Earlier quoted context omitted.

Skimming the blog post, the main difference seems that it allows you to basically store a dict of key/value pairs for each secret. So for example, you could store all the user/pass/host/port for a DB connection as a secret. If I recall correctly, Parameter Store could only store a single SecureString for each secret.

ParameterStore lets you store String, StringList or SecureString. But there's no limit to SecureString. A SecureString can be `postgres://admin:hunter2@localhost:5432/db`. It can also be `{"username": "admin", "password": "hunter2", "host": "localhost", "port": "5432"}`.

Sure you could do that if you don't mind adding in your own string->dict conversion. I wouldn't be surprised if the internal implementation is near-identical. Secrets Manager seems like a slightly more easy-to-use version of Parameter Store that's also visible, instead of hidden away inside Systems Manager.

Re: AWS Secrets Manager – Store, Distribute, and Rotate Credentials Securely

#49

Post by orthecreedence »

0xCMP wrote: post #17
kondro wrote: post #12

At $0.40 per secret per month and $0.05 per 10,000 requests this is much more expensive than the practically free SSM Parameter Store product, even if you factor in the auto-rotating bits.

It'd be cheaper than running Vault with a backing Consul cluster which also provides rotation and other features. There is a point where Vault is more cost effective, but I believe it'd require a ton of requests and secrets to justify min 6 machines of at least t2.micro that also need to managed and secured.

What if you're already running a nomad/consul cluster? Is vault a particularly hard thing to implement/scale at that point?

Re: AWS Secrets Manager – Store, Distribute, and Rotate Credentials Securely

#50

Post by jtwaleson »

As others have noted, the pricing is really the odd thing here. AWS seems to be moving to value based pricing rather than cost based pricing for some of its niche products.

I used to think that Cloudwatch metrics were very expensive at $.50 per custom metric per month, but this seems waaayyyy cheaper to store.

Post reply on HN