4 ms·
If I looked at what this does and none of the surrounding discussion/documentation, I'd say this is to simplify using secrets manager properly more-so than any
by nucleardog 2y ago
If I looked at what this does and none of the surrounding discussion/documentation, I'd say this is to simplify using secrets manager properly more-so than any security purpose.
To use secret manager "properly", in most cases you're gonna need to pull in the entire AWS SDK, maybe authenticate it, make your requests to secret manager, cache values for some sort of lifetime before refreshing, etc.
To use it "less properly", you can just inject the values in environment variables but then there's no way to pick up changes and rotating secrets becomes a _project_.
Or just spin this up and that's all handled. It's so simple you can even use it from your shell scripts.
- TheP1000 2y agoFor anything we inject secrets in via env vars (which really is only supported by ECS, maybe EKS?), it is easy to add a lambda to kick off a nightly ECS restart. Easier if you are already using the AWS CDK for tooling. The purist in me thinks restarts are a hack, but the pragmatist has been around long enough to embrace the simplicity. Adding another dependency/moving piece that AWS could drop support or it could just break also steers me away from this. For Lambda, processes should be getting swapped fast enough and you also normally load during a cold start only. I could see some argument there around improving cold start performance, but would need some testing. So, maybe this is to save a few cents?