Skip to content

Secret Management

Why Needed

In your organization, there may be different kind of secrets involved for different projects such as:

  • SSH keys for EC2 instances (or any server) managed by Ansible
  • Access keys of Users while provisioning infrastructure using Terraform (However OIDC is better solution)
  • Docker registry username, password, registry URL
  • Databases and Services password which are very very sensitive
  • API keys for external services your infra or internal services depend on
  • SSL/TLS or kind of certificates for websites

As a devops engineer you job is to identify sensitivity level of each kind of secrets and store them in different secret management solutions available which depends on:

  • cloud platform you are using (because you may be using hybrid, not only AWS)
  • cost and manageability of secret service
  • blast radius of services or effect level to your organization if secret is leaked

For examples:

  • API keys to retrieving EC2 instance information might have different sensitivity level than of SSH keys used for installing softwares inside EC2 instances.
  • SSL/TLS certificates may be rotated every 90 days but DB password may be rotated every 7 days because it may be highly sensitive for your organization and its blast radius is huge if leaked

So, depending on requirement there are some secret management solutions you can introduce as a practice in your organiaztion — it is not necessary to use only one, you can use multiple solutions when required.

AWS Systems Manager Parameter Store

  • max size is 4KB (standard), 8KB(advanced)
  • rotation is manual or custom scripted via AWS EventBridge (too much work if rotation required)
  • main benefit is cost i.e. on standard tier you can store 10K parameters

When to Choose

  • secret is sensitive but at lower level for example: DB username, Docker registry URL, etc. which has less blast radius
  • low-cost application secrets that rarely changes
  • non-sensitive config params, feat flags, etc.
  • Encryption is pptional with SecureString and AWS KMS

Pricing

To stay free:

  • choose standard tier where parameter limit is up to 10k params per account per region and max value size if 4KB
  • API interactions are free but at standard throughtput (40 requests/second)

Demo

AWS Secret Manager

  • built in rotation/retention policy
  • you can easily integrate with AWS Lambda if custom policy required
  • purpose built for secret management
  • max size up to 64KB
  • AWS KMS encryption at rest with an AWS managed or customer managed key

When to Choose

  • highly sensitive secrets having high blast radius
  • high cost secrets
  • secrets requiring automated rotation
  • basically your DB passwords, service account passowrds, API keys, SSH keys, Access keys, etc.

Pricing

Demo

Hashicorp Vault

When to Choose

  • working with multiple clouds, services
  • you don’t want tightly coupled with one provider
  • before cloud migration or even after as backup store

Pricing

  • see official pricing -> https://www.hashicorp.com/en/pricing but summarized as:
    TierDeploymentPricing ModelClient PricingTypical Use
    Vault Community EditionSelf-hostedFreeNo HCP client chargesLearning, development, self-managed deployments
    HCP Vault — DevelopmentManaged CloudHourly cluster charge; varies by configurationUp to 25 clients/month includedDevelopment, testing, prototyping
    HCP Vault — EssentialsManaged CloudHourly cluster charge; varies by size/regionAdditional client-based pricingProduction workloads
    HCP Vault — StandardManaged CloudHourly cluster charge; varies by size/regionAdditional client-based pricingAdvanced production, scaling, governance
    Vault EnterpriseSelf-hosted or HCPCommercial/contract pricingContract-basedEnterprise and regulated environments

Note

This table is AI generated and better you verify from official pricing documentation.

Demo

Last updated on
IAM – Identity and Access ManagementAWS Config For Compliance