3 ms·

This write-up is solid - but man, this product looks questionable. 40 cents per secret per month? With Credstash[0] or a moral equivalent[1] you pay a buck for

This write-up is solid - but man, this product looks questionable. 40 cents per secret per month? With Credstash[0] or a moral equivalent[1] you pay a buck for a KMS key and microcents for the data storage. RDS rotation is...fine, I guess, if you have an auditor who really wants that and can't write a scheduled job for the task (I've been using one with credstash so long it's just an automatic part of a new environment), but it's got me skeptical. Something AWS could do, and I'd be very interested in, is a hosted moral equivalent to Vault. Give me a daemon or something to run on an instance, allow me to IAM-gate temporary SSH credentials (and chuck it in CloudTrail) and temporary SQL databases, and that I'd pay for 'cause I really don't want to deal with Vault or HashiCorp. But AWS Secrets Manager, by itself, doesn't really present a good reason-for-being to me. [0] - https://github.com/fugue/credstash https://github.com/fugue/credstash [1] - https://github.com/codahale/sneaker https://github.com/codahale/sneaker

Spooky23 8y ago
It’s replacing enterprise products that cost way more to meet compliance requirements. It would have saved me about $50k on a project awhile back. No open source product will meet the requirement, because you often need FIPS validated crypto.
- viraptor 8y ago
  > No open source product will meet the requirement, because you often need FIPS validated crypto. What do you mean? Redhat has FIPS mode. Openssl has FIPS object module. You can create a secrets storage product out of those blocks. Do you mean some specific requirements for the project you were working on?
  - Spooky23 8y ago
    Rolling your own is expensive if you’re getting audited for compliance that includes FIPS or other things. You need to have a Dev who understands and documents everything, your ops guys need to be careful to not fix a security bug in OpenSSL that leaves you with a non-validated version, etc. Or you can give AWS $5/secret/year. It’s the path of least resistance.
    - viraptor 8y ago
      I agree it's simple to use aws in this case. I meant specifically the claim that "No open source product will meet the requirement". It may not be the financially optimal solution, but that's not "open source" specific.
      - Spooky23 8y ago
        I see your POV, but I think the distinction is that RHEL or OpenSSL aren’t vaults. They are components or tools. If RHEL includes a vault product, that would be different. If I need to sit, I need a chair can support my weight. A box containing 2x4s, a hammer and box of nails doesn’t meet the need. I’m not disparaging OSS — it just isn’t a good fit for use cases like this when you need to deal with bullshit like FIPS 140-2.
- eropple 8y ago
  Credstash uses KMS (in much the same way as AWS Secret Provider does) and AES-256 (which is a FIPS 140-2 validated algorithm) internally. If AWS's crypto validates, Credstash's will.
antonvs 8y ago
No enterprise is going to care about that price. If an enterprise is willing to delegate secret management to an external service in the first place, part of the reason they're doing it is so that they don't have to manage it themselves internally, along with the staffing and related compliance issues, which would cost orders of magnitude more.
lozenge 8y ago
Let's say you write a scheduled job - the auditor is going to ask who gets notified when it fails, how you know they will respond to the notification, etc. Much simpler to just rely on AWS to do it for you.
emilpls 8y ago
I do not see the value proposition of the RDS rotation feature. RDS supports IAM auth, which gives you a token that is valid for 15 minutes, no need to worry about rotating passwords anymore: https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.IAMDBAuth.html https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Using...
- cjcampbell 8y ago
  There are several key restrictions on IAM token auth, not to mention that it may not be feasible to integrate in a given framework. It definitely solves the problem for manual access, but automated access may be a different story. That said, there are a handful of examples available to handle RDS secret rotation through parameter store with Lambdas and custom cloudformation resources.

Spooky23 8y ago

It’s replacing enterprise products that cost way more to meet compliance requirements. It would have saved me about $50k on a project awhile back. No open source product will meet the requirement, because you often need FIPS validated crypto.

viraptor 8y ago
> No open source product will meet the requirement, because you often need FIPS validated crypto. What do you mean? Redhat has FIPS mode. Openssl has FIPS object module. You can create a secrets storage product out of those blocks. Do you mean some specific requirements for the project you were working on?
- Spooky23 8y ago
  Rolling your own is expensive if you’re getting audited for compliance that includes FIPS or other things. You need to have a Dev who understands and documents everything, your ops guys need to be careful to not fix a security bug in OpenSSL that leaves you with a non-validated version, etc. Or you can give AWS $5/secret/year. It’s the path of least resistance.
  - viraptor 8y ago
    I agree it's simple to use aws in this case. I meant specifically the claim that "No open source product will meet the requirement". It may not be the financially optimal solution, but that's not "open source" specific.
    - Spooky23 8y ago
      I see your POV, but I think the distinction is that RHEL or OpenSSL aren’t vaults. They are components or tools. If RHEL includes a vault product, that would be different. If I need to sit, I need a chair can support my weight. A box containing 2x4s, a hammer and box of nails doesn’t meet the need. I’m not disparaging OSS — it just isn’t a good fit for use cases like this when you need to deal with bullshit like FIPS 140-2.
eropple 8y ago
Credstash uses KMS (in much the same way as AWS Secret Provider does) and AES-256 (which is a FIPS 140-2 validated algorithm) internally. If AWS's crypto validates, Credstash's will.

antonvs 8y ago

No enterprise is going to care about that price. If an enterprise is willing to delegate secret management to an external service in the first place, part of the reason they're doing it is so that they don't have to manage it themselves internally, along with the staffing and related compliance issues, which would cost orders of magnitude more.

lozenge 8y ago

Let's say you write a scheduled job - the auditor is going to ask who gets notified when it fails, how you know they will respond to the notification, etc. Much simpler to just rely on AWS to do it for you.

emilpls 8y ago

I do not see the value proposition of the RDS rotation feature. RDS supports IAM auth, which gives you a token that is valid for 15 minutes, no need to worry about rotating passwords anymore: https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.IAMDBAuth.html https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Using...

cjcampbell 8y ago
There are several key restrictions on IAM token auth, not to mention that it may not be feasible to integrate in a given framework. It definitely solves the problem for manual access, but automated access may be a different story. That said, there are a handful of examples available to handle RDS secret rotation through parameter store with Lambdas and custom cloudformation resources.