Difference between revisions of "AWS Secrets Manager"
(Created page with "== What is it? == In the past, when you created a custom application to retrieve information from a database, you typically embedded the credentials, the secret, for accessing...") |
|||
| Line 1: | Line 1: | ||
To manage our secrets like API Keys, we choose to use AWS Secrets Manager. It's a service provides by AWS for secrets management. But, why did we choose to use Secrets Manager? Today, security is one of the most important topics in particular in the world of cryptocurrency. Every month, it's common to hear stories about many companies in cryptocurrency that get hacked. So to prevents as much as possible to be part of this kind of story, we are very careful about the security and in this case about the utilization of our secrets. That's the reason, we chose to use Secrets Manager. This service provides the possibility to store our secrets in one place securely. We can also use it and share it with our customers safely. | |||
== What is it? == | == What is it? == | ||
In the past, when you created a custom application to retrieve information from a database, you typically embedded the credentials, the secret, for accessing the database directly in the application. When the time came to rotate the credentials, you had to do more than just create new credentials. You had to invest time to update the application to use the new credentials. Then you distributed the updated application. If you had multiple applications with shared credentials and you missed updating one of them, the application failed. Because of this risk, many customers choose not to regularly rotate credentials, which effectively substitutes one risk for another. | In the past, when you created a custom application to retrieve information from a database, you typically embedded the credentials, the secret, for accessing the database directly in the application. When the time came to rotate the credentials, you had to do more than just create new credentials. You had to invest time to update the application to use the new credentials. Then you distributed the updated application. If you had multiple applications with shared credentials and you missed updating one of them, the application failed. Because of this risk, many customers choose not to regularly rotate credentials, which effectively substitutes one risk for another. | ||
Revision as of 11:33, 2 August 2021
To manage our secrets like API Keys, we choose to use AWS Secrets Manager. It's a service provides by AWS for secrets management. But, why did we choose to use Secrets Manager? Today, security is one of the most important topics in particular in the world of cryptocurrency. Every month, it's common to hear stories about many companies in cryptocurrency that get hacked. So to prevents as much as possible to be part of this kind of story, we are very careful about the security and in this case about the utilization of our secrets. That's the reason, we chose to use Secrets Manager. This service provides the possibility to store our secrets in one place securely. We can also use it and share it with our customers safely.
What is it?
In the past, when you created a custom application to retrieve information from a database, you typically embedded the credentials, the secret, for accessing the database directly in the application. When the time came to rotate the credentials, you had to do more than just create new credentials. You had to invest time to update the application to use the new credentials. Then you distributed the updated application. If you had multiple applications with shared credentials and you missed updating one of them, the application failed. Because of this risk, many customers choose not to regularly rotate credentials, which effectively substitutes one risk for another.
Secrets Manager enables you to replace hardcoded credentials in your code, including passwords, with an API call to Secrets Manager to retrieve the secret programmatically. This helps ensure the secret can't be compromised by someone examining your code, because the secret no longer exists in the code. Also, you can configure Secrets Manager to automatically rotate the secret for you according to a specified schedule. This enables you to replace long-term secrets with short-term ones, significantly reducing the risk of compromise.
Important notions about Secrets Manager
Secret
In Secrets Manager, a secret consists of a set of credentials, user name and password, and the connection details used to access a secured service. You want to store these securely, and ensure only authorized users can access them. Secrets Manager always stores the secret text in an encrypted form and encrypts the secret in transit.
IAM Permission
Secrets Manager uses IAM permission policies to ensure only authorized users can access or modify the secret. You can attach these policies to users or roles, and specify which secrets the users can access.
