Using and Storing Secrets on AWS Secrets Manager

Welcome to this comprehensive guide on securing your sensitive credentials with AWS Secrets Manager. In this lesson, you'll discover how AWS Secrets Manager helps you eliminate the need to hard-code database credentials, API keys, and other secrets in your code, significantly reducing potential security risks.

Traditionally, developers embedded database credentials and other sensitive information directly in their applications or repositories. This practice exposed critical secrets to potential breaches if unauthorized parties accessed your source code. Over the course of my nearly 30-year career, I have witnessed numerous instances where improper secret management led to compromised credentials.

AWS Secrets Manager addresses these risks by securely storing your secrets. Instead of embedding a password or API key in your repository, your application dynamically retrieves an encrypted version of the secret from Secrets Manager at runtime, decrypts it in memory, and then uses it for authentication with the target service. This approach keeps your sensitive information secure and out of the source code.

Secrets Manager not only handles database credentials but also manages application credentials, API keys, tokens, and more. You can interact with Secrets Manager via the AWS CLI or SDK, and secrets are stored as JSON documents with unique names. All secrets are encrypted using AWS KMS and are transmitted securely over TLS/SSL.

Automatic password rotation in AWS Secrets Manager ensures that updated credentials are seamlessly provided to your application. If you encounter exam questions about automated password rotation, remember that AWS Secrets Manager is the correct choice—not the Systems Manager Parameter Store secure strings, as they do not support automatic rotation.

For example, when managing API keys, Secrets Manager dynamically provides the required secret value to your application. This means the API key isn’t embedded in your Lambda code or stored as an environment variable; it remains securely managed by AWS Secrets Manager.

AWS Secrets Manager offers several robust features:

• Secure secret storage with AWS KMS encryption
• Easy and dynamic retrieval of secrets at runtime
• Automatic secret rotation without manual intervention
• Fine-grained access control using IAM policies
• A cost-effective pay-as-you-go pricing model

Note: When using AWS Managed Keys, encryption is free; however, custom KMS keys may incur extra charges.

Secret metadata is an important aspect of managing your secrets. It typically includes details such as the version ID, version stages (e.g., current, previous, or pending), creation date, and the KMS key IDs used for encryption. Below is an example of secret metadata in JSON format:

{
  "Versions": [
    {
      "VersionId": "a11a8133-96ae-4abc-9bfb-e737ae39266e",
      "VersionStages": [
        "AWSPREVIOUS"
      ],
      "CreatedDate": 1692428755.262,
      "KmsKeyIds": [
        "DefaultEncryptionKey"
      ]
    },
    {
      "VersionId": "a2477f83-02a9-457c-b473-c9589c5d7309",
      "VersionStages": [
        "AWSCURRENT"
      ]
    }
  ]
}

In other cases, the metadata may be more comprehensive, including rotation details and IAM permissions:

{
  "Versions": [
    {
      "VersionId": "a11a8133-96ae-4abc-9bfb-e737ae39266e",
      "VersionStages": [
        "AWSPREVIOUS"
      ],
      "CreatedDate": 1692428755.262,
      "KmsKeyIds": [
        "DefaultEncryptionKey"
      ]
    },
    {
      "VersionId": "a2477f83-02a9-457c-b473-c9589c5d7309",
      "VersionStages": [
        "AWSCURRENT"
      ],
      "CreatedDate": 1692428770.661,
      "KmsKeyIds": [
        "DefaultEncryptionKey"
      ]
    }
  ]
}

Furthermore, secrets can be stored as JSON strings containing multiple key-value pairs. For example:

{
  "host": "ProdServer-01.databases.example.com",
  "port": "8888",
  "username": "administrator",
  "password": "EXAMPLE-PASSWORD",
  "dbname": "MyDatabase",
  "engine": "mysql"
}

Secrets Manager also supports replicating secrets across multiple AWS regions, which enhances disaster recovery and reduces latency for distributed applications. Replication ensures that a secret from one region is copied to another region with an updated Amazon Resource Name (ARN). For example:

arn:aws:secretsmanager:RegionA:123456789012:secret:secret1

After replication, in a different region the ARN will appear as:

arn:aws:secretsmanager:RegionB:123456789012:secret:secret1

Rotating secrets in AWS Secrets Manager can be done effortlessly. The service automatically updates credentials based on your specified interval while keeping previous versions for reference. In the past, a custom Lambda function was required for rotation, but many modern services now support native rotation natively.

AWS Secrets Manager also supports secret versioning. Versions can be labeled as current, previous, or pending, and you even have the flexibility to create custom labels. Unlabeled versions are automatically deprecated if more than 100 versions exist, with a grace period of 24 hours before deletion.

There are two primary rotation strategies available:

1. Single-User Rotation Strategy:
   In this strategy, a single user with access to a resource (such as a database) is used. AWS Secrets Manager rotates the secret at a defined interval, updates the resource with new credentials, and ensures the application retrieves the most recent version.

   

2. Alternating User Rotation Strategy:
   This strategy involves creating two users with identical permissions. The rotation alternates between these two users, allowing one secret to remain active while the other is updated and verified, ensuring a smooth transition between credentials.

   

For clarity, consider the following comparison highlighting key differences between the two rotation strategies:

While the alternating user strategy offers advanced permission controls, a single-user rotation strategy often provides sufficient security and simplicity for many applications.

Thank you for reading this guide on AWS Secrets Manager. We hope this article enhances your understanding of secure secret management, automated password rotation, and the benefits of region replication. For more insights, consider exploring additional AWS documentation and best practices.