Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

AWS Secrets Manager – Store, Distribute, and Rotate Credentials Securely

aws.amazon.com

Post reply on HN
Print view View original

91–100 of 137 posts

Re: AWS Secrets Manager – Store, Distribute, and Rotate Credentials Securely

#91

Post by ppierald »

There is a lot of commentary about the use of vault as an alternative, number of secrets needed, etc. I think the inclusion of Secrets Manager is a great addition for AWS and will definitely help people get better control over their secrets, however, vault contains richer functionality than just secrets key/value storage.

It can provision users to backends like SSH, databases, cloud providers, and such. Use is audited, can be revoked, and has a TTL associated.

Additionally, vault contains a full "crypto-in-a-box" implementation that allows for sign/verify, hmac/verify, encrypt/decrypt, random number generation, and other functions.

So I applaud AWS for doing this and hope the will continue developing KMS/HSM/Parameter Store/Secret Store/??? in the future and innovating, but evaluating Secret Store vs. Vault simply on price may be a short sighted comparison.

Disclaimers: Employer is an AWS customer using vault

Re: AWS Secrets Manager – Store, Distribute, and Rotate Credentials Securely

#92

Post by drodgers »

I was hoping to use this for RDS parameters (to get automatic rotation) and leave everything else in ParameterStore.

Unfortunately — although I'm sure it's built on-top of ParameterStore internally — I just checked and you can't see SecretsManager secrets in ParameterStore, so an application would need to read from both and merge them, or switch entirely to SecretsManager to take advantage of the automatic rotation.

Re: AWS Secrets Manager – Store, Distribute, and Rotate Credentials Securely

#93

Post by jcims »

whateveracct wrote: post #7

This looks like an AWS equivalent of the Amazon-internal secret management tool called Odin. Which is very nice because Odin was pretty much universally loved from what I saw.

Surprised at all the folks openly discussing internal tooling.

Re: AWS Secrets Manager – Store, Distribute, and Rotate Credentials Securely

#94

Post by WaxProlix »

ronnier wrote: post #45
whateveracct wrote: post #7

This looks like an AWS equivalent of the Amazon-internal secret management tool called Odin. Which is very nice because Odin was pretty much universally loved from what I saw.

After leaving Amazon you really go on to understand how good the internal tools are at Amazon and how they probably have the best tools in the industry.

Except SIM.

Re: AWS Secrets Manager – Store, Distribute, and Rotate Credentials Securely

#95

Post by harryh »

ronnier wrote: post #45
whateveracct wrote: post #7

This looks like an AWS equivalent of the Amazon-internal secret management tool called Odin. Which is very nice because Odin was pretty much universally loved from what I saw.

After leaving Amazon you really go on to understand how good the internal tools are at Amazon and how they probably have the best tools in the industry.

As a former Googler, I know a lot of Googlers that feel exactly the same way. It would be interesting for someone who has deeply experienced both to weigh in.

Re: AWS Secrets Manager – Store, Distribute, and Rotate Credentials Securely

#97

Post by 013a »

crazypyro wrote: post #77
013a wrote: post #51

> $0.40/secret/month WOWZER. I get having a managed solution is great, but you don't have to store many secrets before running your own Vault server makes sense.

At my work, we have a vault service, but it takes 3 servers for vault plus another 3 for consul and they are not very cheap servers (m4.larges). Our rough calculations, using a 3x3 vault/consul architecture, estimated you'd need over 1100-1300 secrets to make it worth implementing vault (not including development/maintenance cost which could be significant. and if you have multiple, independent environments, it gets…

If you're already deployed inside Kubernetes or similar, Vault is Just Another Pod that is running, with HA and everything. You might not even need to add to your resource pool that is already provisioned. As for your backend, S3 is a great choice if you can tolerate no-HA, or DynamoDB if not.

Point being: if you're using a modern stack, you can use modern tools. If you're stuck on a legacy stack, you use legacy tools, and that appears to be who AWS is building for nowadays. Legacy tools, value-based pricing instead of cost-based, charge a boatload, buzzword heaven, sell it to the enterprise, rinse repeat.

The HSM component is the only part here that appears to be worth the price. Azure's competing product is a LOT cheaper, except that their HSM-generated keys are more expensive. Which naturally means, Azure is cost-based pricing, whereas AWS is value-based pricing.

Re: AWS Secrets Manager – Store, Distribute, and Rotate Credentials Securely

#98

Post by netvisao »

I am curious as to how it handles those race conditions where a connection is made with the older credentials just after the time the rds master key rotates, or a connection is made with the newer credentials just before the time the rds client key rotates. Short of using two credentials accounts ...

Re: AWS Secrets Manager – Store, Distribute, and Rotate Credentials Securely

#99

Post by mabbo »

jcims wrote: post #93
whateveracct wrote: post #7

This looks like an AWS equivalent of the Amazon-internal secret management tool called Odin. Which is very nice because Odin was pretty much universally loved from what I saw.

Surprised at all the folks openly discussing internal tooling.

There are a specific set of internal things at Amazon that public discussion of would be detrimental to your career. Saying what you think of Odin isn't quite the same as mentioning the release date of the next Kindle.

Re: AWS Secrets Manager – Store, Distribute, and Rotate Credentials Securely

#100

Post by mabbo »

ronnier wrote: post #45
whateveracct wrote: post #7

This looks like an AWS equivalent of the Amazon-internal secret management tool called Odin. Which is very nice because Odin was pretty much universally loved from what I saw.

After leaving Amazon you really go on to understand how good the internal tools are at Amazon and how they probably have the best tools in the industry.

Brazil + Apollo + Pipelines. I left (and later boomeranged) and was surprised that the outside world hadn't solved these problems nearly as well. Don't get me wrong, Brazil and Apollo probably are ready for a rethink and rewrite, but they do a great job.
Post reply on HN