At $0.40 per secret it would have been nice if they had a 5 secret free tier.
That would get smaller users to start using it instead of parameter store and eventually realize the value of automated and audited secret rotation
AWS Secrets Manager – Store, Distribute, and Rotate Credentials Securely
81–90 of 137 posts
Re: AWS Secrets Manager – Store, Distribute, and Rotate Credentials Securely
#82First reaction: Holy crap! They finally turned ParameterStore into a proper product! Second reaction: Holy shit that's expensive [for what it does]. ParameterStore is free (minus the KMS component). The only value-add is secret rotation and that's not something that most of the time makes sense to use. [Edit: I'm not advocating for no rotation; see replies] Edit: Had more time to think about it. Someone enlighten me:…
The pricing is a bit surprising, but I am sure that if you tried to build the full solution you would end up needing a few more pieces than just the rotation lambda and cron.
Would have been nice if there was a 5 secret free tier though. I feel like the sticker shock will dissuade small users when everybody really should be doing secret rotation.
Re: AWS Secrets Manager – Store, Distribute, and Rotate Credentials Securely
#83> $0.40/secret/month WOWZER. I get having a managed solution is great, but you don't have to store many secrets before running your own Vault server makes sense.
How many secrets do you think you'll have? 400? 4000? We're still within pennies range compared to doing this securely yourself.
Re: AWS Secrets Manager – Store, Distribute, and Rotate Credentials Securely
#84First reaction: Holy crap! They finally turned ParameterStore into a proper product! Second reaction: Holy shit that's expensive [for what it does]. ParameterStore is free (minus the KMS component). The only value-add is secret rotation and that's not something that most of the time makes sense to use. [Edit: I'm not advocating for no rotation; see replies] Edit: Had more time to think about it. Someone enlighten me:…
My biggest criticism of Parameter Store is actually that it's free. Let me explain: Because it's free they limit the requests per seconds you can make to the Parameter Store. That's especially noticeable when doing requests for all parameters of a given path, as the limit is way lower there than for requesting (a bunch of) individual parameters. In the past that caused serious problems for us when using Parameter Sto…
Oh, yeah, we just ran into this recently when rolling-out parameter store. For anyone else having this problem, the trick was to use the GetParametersByPath API method (https://docs.aws.amazon.com/systems-manager/latest/APIRefere...) instead of the more flexible DescribeParameters (which has stupidly low, undocumented rate limits).
Re: AWS Secrets Manager – Store, Distribute, and Rotate Credentials Securely
#85Earlier quoted context omitted.
With an SSH CA.
Is there one of those you’d recommend?
Check out Hashicorp Vault (https://www.vaultproject.io/docs/secrets/ssh/signed-ssh-cert...) for a general product (has lots of the features of AWS Secrets Manager as well), or Netflix BLESS (https://github.com/Netflix/bless) for a very specific tool for just this.
Re: AWS Secrets Manager – Store, Distribute, and Rotate Credentials Securely
#86First reaction: Holy crap! They finally turned ParameterStore into a proper product! Second reaction: Holy shit that's expensive [for what it does]. ParameterStore is free (minus the KMS component). The only value-add is secret rotation and that's not something that most of the time makes sense to use. [Edit: I'm not advocating for no rotation; see replies] Edit: Had more time to think about it. Someone enlighten me:…
How many secrets do you have? Even with thousands this doesn't seem expensive, and if you have 1000's you're probably mature enough to pay a bit.
Re: AWS Secrets Manager – Store, Distribute, and Rotate Credentials Securely
#87Anyone know how this compares to Azure Key Vault?
Vault already did secrets.
Nothing stops you from writing an azure function to handle rotation, but you gotta build it yourself. AWS has BUILT IN support for RDS.
However, the biggest delta is: I'm like 90% sure Azure key vault doesn't have fine-grained access policy per VAULT. That kind of stinks.. you need a vault per role ideally.
Re: AWS Secrets Manager – Store, Distribute, and Rotate Credentials Securely
#88Earlier quoted context omitted.
What's the backend? If it's HSM, that would explain the steep price (sort of).
Would be very surprised if it's not backed by AWS HSM. About 2 years ago I believe AWS KMS-->HSM was leveraging SafeNet's Luna HSM.
The SafeNet product is now called "CloudHSM Classic". The current CloudHSM is documented to use the Cavium NITROX HSM, which in the PCI HSM format is partitionable into "virtual HSMs". This looks pretty much designed for cloud HSM providers.
Secrets Manager is very likely backed by KMS which appears to use a KMS-specific HSM module (judging by https://csrc.nist.gov/csrc/media/projects/cryptographic-modu...)
Re: AWS Secrets Manager – Store, Distribute, and Rotate Credentials Securely
#89First reaction: Holy crap! They finally turned ParameterStore into a proper product! Second reaction: Holy shit that's expensive [for what it does]. ParameterStore is free (minus the KMS component). The only value-add is secret rotation and that's not something that most of the time makes sense to use. [Edit: I'm not advocating for no rotation; see replies] Edit: Had more time to think about it. Someone enlighten me:…
How many secrets do you have? Even with thousands this doesn't seem expensive, and if you have 1000's you're probably mature enough to pay a bit.
To be clear, this would be peanuts to my company. But it's super expensive for what it is especially because they have a free service that does the same thing right next to it.
Re: AWS Secrets Manager – Store, Distribute, and Rotate Credentials Securely
#90Earlier quoted context omitted.
What are you assuming about exposure? If a SSH key lives on a well-secured workstation or bastion host (and you ideally don't agent-forward it to insecure hosts), rotating that key once per hour doesn't seem a top priority to me? E.g. a sudo password is (lower-impact, but) more likely to get exposed to compromised hosts? ("Well-secured workstation" is arguably an oxymoron, of course...)
Wait, you keep private SSH keys on bastion hosts? It's much better practice to use the bastion as a proxy to the other hosts. This is easily achieved using the ProxyCommand option of OpenSSH. No agent forwarding, no secrets kept in random hosts.
Do you know a good guide with standard practices for setting up and securing bastion hosts (preferably on aws)?