Concepts

AWS Secrets Manager is a service designed specifically for storing, managing, and retrieving secrets. It helps you protect access to your applications, services, and IT resources without the upfront investment and on-going maintenance costs of operating your own infrastructure.

Key Features:

  • Secret Rotation: AWS Secrets Manager can automatically rotate the secrets without user intervention.
  • Fine-Grained Policies: It allows you to set fine-grained policies for who can access a secret.
  • Integration with AWS Services: Can be used seamlessly with other AWS services such as RDS, Redshift, and DocumentDB.
  • Centralized Management: Centralize the management of secrets and the retrieval of the encrypted values.

Use Case Example:

Imagine you have an application that requires access to a database with sensitive information. Without exposing the credentials in your code, you could store them securely in AWS Secrets Manager. The application retrieves the database credentials when it needs to establish a connection, thus maximizing security.

AWS Systems Manager Parameter Store

The AWS Systems Manager Parameter Store provides secure, hierarchical storage for configuration data and secrets management. You can store values as plain text or encrypted data.

Key Features:

  • Hierarchies: It supports organizing parameters into hierarchies and managing access at different levels.
  • Integrations: It is integrated with other AWS services and the AWS SDK, simplifying its utilization within your applications.
  • Auditing and Monitoring: It integrates with AWS CloudTrail and CloudWatch for logging and monitoring of parameter access.

Use Case Example:

For an application that requires storing configuration data like feature flag statuses or environment-specific data, AWS Systems Manager Parameter Store can be used. Developers can pull configuration data from Parameter Store as needed, ensuring these values aren’t hardcoded in the application.

Comparison

Feature/Service AWS Secrets Manager AWS Systems Manager Parameter Store
Purpose Manages secrets with rotation and lifecycle management capabilities Stores parameters/config data with optional encryption
Automatic Rotation of Secrets Yes No
Pricing Based on the number of secrets and API calls Free for standard parameters, charges for advanced parameters
Storage Limits 64 KiB per secret Standard: 4 KB, Advanced: 8 KB per parameter
Integration with AWS Services Native integrations to rotate AWS service credentials Some integrations requiring additional orchestration
Audit & Monitoring Integrated with AWS auditing services Integrated with AWS auditing services
Fine-Grained Access Control Detailed policies and resource-based permissions Resource-based permissions, less granular than Secrets Manager

Retrieving Secrets in Code Example (Python using Boto3 library)

To demonstrate how a developer can retrieve a secret from AWS Secrets Manager:

import boto3
from botocore.exceptions import ClientError

def get_secret():
secret_name = “my_database_secret”
region_name = “us-west-2”

# Create a Secrets Manager client
session = boto3.session.Session()
client = session.client(service_name=’secretsmanager’, region_name=region_name)

try:
# Pull the secret value from Secrets Manager
get_secret_value_response = client.get_secret_value(SecretId=secret_name)
except ClientError as e:
raise e
else:
# In this case, the secret value is a string
secret = get_secret_value_response[‘SecretString’]
return secret

# Use the retrieved secret to work with your database or any other service that requires the secret

Retrieving Parameters in Code Example (Python using Boto3 library)

To demonstrate how a developer can retrieve parameters from AWS Systems Manager Parameter Store:

import boto3

def get_parameter():
parameter_name = “my_config_parameter”
region_name = “us-west-2”

# Create a Systems Manager client
ssm = boto3.client(‘ssm’, region_name=region_name)

# Pull the parameter value from Parameter Store
parameter = ssm.get_parameter(Name=parameter_name, WithDecryption=True)

value = parameter[‘Parameter’][‘Value’]
return value

# Use the retrieved parameter in your application’s configuration

Conclusion

As part of the AWS Certified Developer – Associate exam, understanding when and how to use AWS Secrets Manager and AWS Systems Manager Parameter Store is necessary for managing sensitive information effectively. Through hands-on experience and practical implementation, developers can ensure they are adhering to best practices for secrets management endorsed by AWS.

Answer the Questions in Comment Section

True or False: AWS Secrets Manager automatically rotates secrets for AWS RDS databases.

  • True
  • False

Answer: True

Explanation: AWS Secrets Manager has the capability to automatically rotate secrets for supported AWS RDS databases.

Which AWS service is primarily used for storing and retrieving configuration data and secrets?

  • AWS Config
  • AWS KMS
  • AWS Secrets Manager
  • AWS Systems Manager Parameter Store

Answer: AWS Secrets Manager

Explanation: AWS Secrets Manager is designed specifically for storing, managing, and retrieving secrets.

Which of the following can be used for secrets management in AWS? (Select TWO)

  • AWS CloudFormation
  • AWS Secrets Manager
  • Amazon S3
  • AWS Systems Manager Parameter Store
  • AWS CodeDeploy

Answer: AWS Secrets Manager, AWS Systems Manager Parameter Store

Explanation: Both AWS Secrets Manager and AWS Systems Manager Parameter Store can be used for secrets management on AWS.

True or False: AWS Secrets Manager does not provide the functionality to directly retrieve secrets from within a Lambda function.

  • True
  • False

Answer: False

Explanation: AWS Secrets Manager provides functionality to retrieve secrets directly from Lambda functions using the appropriate AWS SDK or CLI.

What is the key benefit of using AWS Secrets Manager over hardcoded secrets in your application code?

  • Lower costs
  • Improved performance
  • Ease of updates
  • Enhanced security

Answer: Enhanced security

Explanation: Storing secrets in AWS Secrets Manager, as opposed to hardcoding them in your code, enhances security by centralizing secret management and access control.

True or False: Secrets Store in AWS Systems Manager Parameter Store are free, regardless of the number of secrets and operations performed.

  • True
  • False

Answer: False

Explanation: While there is a standard tier that is free for up to a certain number of secrets and operations, AWS Systems Manager Parameter Store also has an advanced tier which provides enhanced features and is subject to additional costs.

What feature does AWS Secrets Manager have that AWS Systems Manager Parameter Store does not?

  • Hierarchical storage
  • Secret rotation
  • Tagging of secrets
  • Encryption using KMS

Answer: Secret rotation

Explanation: One of the key features of AWS Secrets Manager is the built-in ability to rotate secrets automatically, which is not an inherent feature of AWS Systems Manager Parameter Store.

True or False: AWS Secrets Manager supports secret rotation using a custom AWS Lambda function.

  • True
  • False

Answer: True

Explanation: AWS Secrets Manager supports the use of custom AWS Lambda functions to define how secrets should be rotated.

In AWS Secrets Manager, what is the recommended practice for granting an application the least privilege to retrieve a secret?

  • Attach an IAM policy directly to the secret
  • Use an IAM role with the necessary permissions and assign it to the application
  • Create an Access Key ID and Secret Access Key for the application
  • Use the root account for any operations on the secret

Answer: Use an IAM role with the necessary permissions and assign it to the application

Explanation: The recommended best practice is to use an IAM role with the least privilege necessary and associate it with the application to allow it to retrieve the secret.

When viewing a secret in the AWS Secrets Manager console, are you able to directly see the secret’s plaintext value?

  • Yes, the secret is shown in plaintext
  • No, you must explicitly request to retrieve and decrypt the secret value

Answer: No, you must explicitly request to retrieve and decrypt the secret value

Explanation: Secrets in AWS Secrets Manager are not displayed outright; you need to explicitly request to view or retrieve the plaintext value of a secret.

True or False: You can store both binary and plaintext secret data in AWS Systems Manager Parameter Store.

  • True
  • False

Answer: True

Explanation: AWS Systems Manager Parameter Store supports both plaintext (string and string list) and encrypted data types, allowing for the storage of binary data.

Which service provides both organization and management for secrets, including hierarchical organization and labeling?

  • AWS Secrets Manager
  • AWS Systems Manager Parameter Store
  • AWS CloudTrail
  • AWS Identity and Access Management (IAM)

Answer: AWS Systems Manager Parameter Store

Explanation: AWS Systems Manager Parameter Store enables hierarchical storage of data and the use of path-based naming, which provides the ability to organize and manage secrets in a structured manner.

0 0 votes
Article Rating
Subscribe
Notify of
guest
24 Comments
Oldest
Newest Most Voted
Inline Feedbacks
View all comments
Cooper Green
6 months ago

Great post on secrets management! Very helpful for the AWS Certified Developer exam.

Kasper Jensen
7 months ago

Can someone explain how AWS Secrets Manager differs from AWS Systems Manager Parameter Store?

Susanne Havik
7 months ago

Thank you for this informative post!

Carl Jørgensen
7 months ago

Does anyone have experience with implementing secrets management in a CI/CD pipeline?

Nathan Anderson
7 months ago

Nice explanation, it’s a great resource for the DVA-C02 exam.

Bertine Lauritsen
7 months ago

I think the blog could use more diagrams to explain the process better.

Deborah Butler
8 months ago

For Parameter Store, how can I ensure the parameters are encrypted?

Larry Frazier
7 months ago

Appreciate the effort in putting this together!

24
0
Would love your thoughts, please comment.x
()
x