> $0.40/secret/month
WOWZER. I get having a managed solution is great, but you don't have to store many secrets before running your own Vault server makes sense.
AWS Secrets Manager – Store, Distribute, and Rotate Credentials Securely
51–60 of 137 posts
Re: AWS Secrets Manager – Store, Distribute, and Rotate Credentials Securely
#52At $0.40 per secret per month and $0.05 per 10,000 requests this is much more expensive than the practically free SSM Parameter Store product, even if you factor in the auto-rotating bits.
It'd be cheaper than running Vault with a backing Consul cluster which also provides rotation and other features. There is a point where Vault is more cost effective, but I believe it'd require a ton of requests and secrets to justify min 6 machines of at least t2.micro that also need to managed and secured.
Depends on how many secrets you're storing.
You can also back Vault with something other than Consul. You can back it with DynamoDB, which would be much cheaper than managing your own Consul cluster. You can even back it with S3, which would be dirt cheap (cost of the vault instance + a few cents for storage).
Re: AWS Secrets Manager – Store, Distribute, and Rotate Credentials Securely
#53> $0.40/secret/month WOWZER. I get having a managed solution is great, but you don't have to store many secrets before running your own Vault server makes sense.
FTFU - Valut service.... You need more than one server, it'll need to have 100% uptime too, backed up and available in multiple regions. No security team want to own this infrastructure.
Re: AWS Secrets Manager – Store, Distribute, and Rotate Credentials Securely
#54This looks like an AWS equivalent of the Amazon-internal secret management tool called Odin. Which is very nice because Odin was pretty much universally loved from what I saw.
There's still a bootstrap issue with AWS Secrets Manager - you have to set up enough tooling to be able to call the API. The killer-app of odin imho was/is the on-machine http server that let all manner of applications very easily get credentials. You could just do something like MY_API_KEY="$(curl http://localhost:5000?key=my-api)" and boom your shell script or whatever was very easily using secrets. The fact that A…
That is actually pretty scary from a security perspective because of SSRF attacks. Basically if I can get your service to make an HTTP request on my behalf then I can get at your secrets.
Suppose you have a service that fetches snippets from user pasted links (like Slack does). All I have to do is paste a link of "http://localhost:5000?key=my-api" and your server would return a snippet containing the secret.
Thats why Google Cloud and others require a special header to be set. Hopefully Odin does the same? https://cloud.google.com/compute/docs/storing-retrieving-met...
Re: AWS Secrets Manager – Store, Distribute, and Rotate Credentials Securely
#55$0.40 per secret per month is outrageous.
Re: AWS Secrets Manager – Store, Distribute, and Rotate Credentials Securely
#56This looks like an AWS equivalent of the Amazon-internal secret management tool called Odin. Which is very nice because Odin was pretty much universally loved from what I saw.
There's still a bootstrap issue with AWS Secrets Manager - you have to set up enough tooling to be able to call the API. The killer-app of odin imho was/is the on-machine http server that let all manner of applications very easily get credentials. You could just do something like MY_API_KEY="$(curl http://localhost:5000?key=my-api)" and boom your shell script or whatever was very easily using secrets. The fact that A…
This is exactly how things already work on EC2.
https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-role...
TL;DR;
curl http://169.254.169.254/latest/meta-data/iam/security-credentials/s3access
Re: AWS Secrets Manager – Store, Distribute, and Rotate Credentials Securely
#57First reaction: Holy crap! They finally turned ParameterStore into a proper product! Second reaction: Holy shit that's expensive [for what it does]. ParameterStore is free (minus the KMS component). The only value-add is secret rotation and that's not something that most of the time makes sense to use. [Edit: I'm not advocating for no rotation; see replies] Edit: Had more time to think about it. Someone enlighten me:…
What's the backend? If it's HSM, that would explain the steep price (sort of).
Would be very surprised if it's not backed by AWS HSM. About 2 years ago I believe AWS KMS-->HSM was leveraging SafeNet's Luna HSM.
Re: AWS Secrets Manager – Store, Distribute, and Rotate Credentials Securely
#58Kinda similar to what Hashicorp's Vault does for secret management but hosted.
I believe that's what HC's Vault Enterprise is (hosted/SaaS): https://www.hashicorp.com/products/vault
Re: AWS Secrets Manager – Store, Distribute, and Rotate Credentials Securely
#59Earlier quoted context omitted.
There's still a bootstrap issue with AWS Secrets Manager - you have to set up enough tooling to be able to call the API. The killer-app of odin imho was/is the on-machine http server that let all manner of applications very easily get credentials. You could just do something like MY_API_KEY="$(curl http://localhost:5000?key=my-api)" and boom your shell script or whatever was very easily using secrets. The fact that A…
That is actually pretty scary from a security perspective because of SSRF attacks. Basically if I can get your service to make an HTTP request on my behalf then I can get at your secrets. Suppose you have a service that fetches snippets from user pasted links (like Slack does). All I have to do is paste a link of " http://localhost:5000?key=my-api" and your server would return a snippet containing the secret. Thats w…
This is already an issue on EC2.
https://ionize.com.au/stealing-amazon-ec2-keys-via-xss-vulne...
Re: AWS Secrets Manager – Store, Distribute, and Rotate Credentials Securely
#60> $0.40/secret/month WOWZER. I get having a managed solution is great, but you don't have to store many secrets before running your own Vault server makes sense.
FTFU - Valut service .... You need more than one server, it'll need to have 100% uptime too, backed up and available in multiple regions. No security team want to own this infrastructure.
Yeah, it's a minimum of 2 instances per region, and you should also run Consul or some other replicated backend, etc. Been there, done that; it gets complicated pretty quickly.
That being said, if the security traffic and/or amount of data is huge, Vault might be cheaper, even with the extra work. I guess it depends on the scenario.