Introduction to AWS Secrets Manager

© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved
Pop-up Loft
Introduction to AWS Secrets Manager
Dave McDermitt,
Advisor – Global Security / Risk / Compliance
AWS Professional Services

What is a secret?
• Definition: Something that is meant to be kept unknown or unseen by others.
• In our context we’ll limit our consideration of secrets to those related to securing
information
• Many different types:
– Authenticators
• Passwords
• API keys
– Encryption keys
• Symmetric
• Asymmetric
– Etc…

But what is the most important aspect of a secret?
• Definition: Something that is meant to by others.
• The problem:
– How do you keep something unknown or unseen if it has to be shared in order to be
used?
be kept unknown or unseen

What are the challenges?
Existing solutions are
complex to operate or
too expensive
Unreliable rotation
processes
Too many humans with
unnecessary access to
secrets

What do you need to do?
Connect to databases,
APIs, and other resources,
using the secrets that
existing resources require.
Rotate secrets regularly
without breaking stuff.
Maintain control and
visibility over where, how,
and by whom secrets are
used.

Introducing AWS Secrets Manager
Lifecycle management for secrets such
as database credentials and API keys.
Rotate Secrets
Safely
Pay as you goManage access
with fine-grained
policies
Secure and
audit secrets
centrally

Key Features
Safe rotation of
secrets
Built-in integrations,
extensible with
Lambda
On-demand or
automatic rotation
with versioning
Fine-grained access
policies
Encrypted storage Logging and
monitoring

Typical Use Cases

Typical Use Cases
Connect to database from application
code
• DBA loads application specific database
credentials into AWS Secrets Manager.
• DevOps engineer deploys application
with an attached AWS IAM role.
• Application bootstrapping calls Secrets
Manager using permissions provided by
the IAM role, retrieves credentials, and
connects to the database.

Typical Use Cases
Rotate database credentials used by
application code without interruption
• Secrets Manager creates a new
credential with equivalent permissions.
• The new credential is promoted and
returned via subsequent Secrets
Manager API calls.
• Secrets Manager safely disables the
original credential.

Typical Use Cases
Store application secrets
• Application authenticates user with
Open ID Connect, and uses access token
to make API calls on behalf of user.
• Application stores OAuth refresh token
in Secrets Manager.
• When access token expires, the app
retrieves refresh token and uses it to
fetch a new access token.

Technical Deep Dive

Background: IAM Roles
AWS
Resources
Your Code
Operating
System
EC2 Instance
AWS credentials auto
delivered and rotated
AWS credentials auto
discovered and used
Access controlled by
policy attached to role
Also works with AWS Lambda & Amazon ECS

Retrieve Secret
AWS
Resources
Your Code
Operating
System
EC2 Instance
Authorized call toSecrets Manager
Other
Resources
AWS credentials
plumbed (as before)
DB creds
loaded
DB creds returnedconnection established
Safe
rotation
Combo provides your apps a reliable, secure, auto-rotating solution for ALL credentials

Rotate Secret (Integrated)
AWS
Secrets
Manager
Your
Code
Integrated
Backend
Resource
1) Rotation event 2) New credential
creation initiated
3) New credential
creation
completed
4) New credential
promoted to
active
5) Secret retrieval
gets new version
6) Connection using new credential

Fine grained access controls
Implement using IAM Policies
• Specify permissions attached to IAM principals (roles, users,
or groups).
• Control secret management (e.g. rotation, metadata) and use
(e.g. retrieval) independently.
• Use secret id or tags to define fine grained access controls to
collections of secrets or an individual secret.
Controlling management and access to secrets

Encryption
At-rest
• Secrets encrypted at rest
using AWS Key Management
Service (KMS).
• Choose your desired Customer
Master Key (CMK) or AWS
managed default encryption
key.
In-transit
• Secrets encrypted in transit
using Transport Layer Security
(TLS).
• All API calls authenticated by
SigV4 verification.
All secrets protected at-rest and in-transit

Comparing AWS Systems Manager Parameter Store
AWS Systems Manager
Parameter Store
AWS Secrets Manager
• Secure storage for configuration data,
which can include secrets.
• Reference values using the unique
name specified during creation.
• Use parameters in scripts for
configuration and automation.
• A service to manage the lifecycle for
secrets in your organization.
• Helps you meet security and compliance
requirements by rotating secrets
automatically.
• Built-in integrations for Amazon RDS that
can rotate database credentials on your
behalf.
• Extensible via Lambda.

Pricing & Availability

Pricing & Availability
• Pay only for what you use. No minimum fee.
• Two dimensions: storage and access.
• Storage: $0.40 per month per secret
• Access: $0.05 per 10,000 API calls (reads and writes)
• Currently available in:
• US East (N. Virginia & Ohio) US West (N. California & Oregon)
• Asia Pacific (Mumbai, Seoul, Singapore, Sydney, Tokyo)
• EU (Frankfurt, Ireland, London)
• Canada (Central), South America (Sao Paulo)

Getting Started
Setup
• Grant permissions
manage secrets to
appropriate IAM
roles, users, or
groups (IAM
Administrator
action)
Store Secret
• Choose secret type
• Choose encryption
key
• Select associated
resource
• Configure rotation
• Provide initial value
Retrieve Secret
• Retrieve secret
using CLI, API, or
AWS Management
Console

Questions

Pop-up Loft
aws.amazon.com/activate
Everything and Anything Startups
Need to Get Started on AWS

Introduction to AWS Secrets Manager

More Related Content

Introduction to AWS Secrets Manager