Store and use secrets securely

A workload requires an automated capability to prove its identity to databases, resources, and third-party services. This is done using secret access credentials such as API keys, passwords, and OAuth tokens. To reduce the likelihood of these credentials becoming compromised, it is essential to use a purpose-built service for storing, managing, and rotating them.

1. Use AWS Secrets Manager or AWS Systems Manager Parameter Store: These services allow you to securely store and manage secrets such as database credentials, API keys, and tokens. Secrets Manager also automatically rotates credentials, minimizing the risk of credential exposure.
2. Encrypt secrets at rest and in transit: Ensure that all secrets are encrypted both at rest and in transit. AWS Secrets Manager and Parameter Store handle encryption using AWS Key Management Service (KMS) by default, ensuring that secrets are always securely stored and accessed.
3. Rotate secrets automatically: Configure automatic rotation of secrets, such as passwords and API keys, using AWS Secrets Manager. This reduces the risk of long-term credentials being exposed or compromised by ensuring that secrets are regularly updated without manual intervention.
4. Control access using IAM policies: Restrict access to stored secrets by applying fine-grained IAM policies. Ensure that only authorized services, applications, and users can retrieve secrets, and limit access based on the principle of least privilege.
5. Audit and monitor secret usage: Use AWS CloudTrail and AWS Config to monitor access to secrets. Regularly review logs to detect any unauthorized or suspicious attempts to access stored secrets, ensuring any potential threats are addressed promptly.

Supporting Questions:

• How are secrets such as API keys and database credentials stored securely in your environment?
• What tools or services do you use to automatically rotate secrets?
• How do you monitor and audit access to sensitive credentials?

Roles and Responsibilities:

Security Engineer:

• Responsibilities:
  • Configure and manage AWS Secrets Manager or AWS Systems Manager Parameter Store to securely store and rotate secrets.
  • Ensure encryption is applied to all secrets both at rest and in transit.
  • Define and enforce access control policies for retrieving secrets.

DevOps Engineer:

• Responsibilities:
  • Integrate secret management tools into applications and workloads to securely retrieve credentials.
  • Automate the rotation of secrets within the pipeline and ensure applications can handle secret updates.

Artefacts:

• Secrets Manager Configuration: Documentation outlining how secrets are stored, encrypted, and rotated using AWS Secrets Manager or Parameter Store.
• IAM Access Policies: Records detailing the policies that control access to stored secrets, ensuring they follow least privilege principles.
• CloudTrail and Config Logs: Logs that track secret access and usage, providing an audit trail for security reviews and compliance.

Relevant AWS Services:

• AWS Secrets Manager: A service to securely store, manage, and automatically rotate secrets such as database credentials, API keys, and OAuth tokens. It ensures secrets are encrypted and simplifies access control.
• AWS Systems Manager Parameter Store: A service that provides a secure way to store configuration data and secrets, including passwords and tokens. It supports KMS encryption and integrates with AWS services.
• AWS Key Management Service (KMS): A service that helps to create and manage cryptographic keys used to encrypt secrets stored in AWS Secrets Manager or Parameter Store.
• AWS CloudTrail: A service that enables logging and monitoring of all actions taken on secrets stored in AWS services, providing an audit trail for access and modifications.
• AWS Config: A service that helps monitor and track the configuration of AWS resources, including ensuring that secrets are managed securely.