AWS Secrets Manager presentation on Best Practices, use cases on Amazon Web Services, Secrets Manager, ansible, CI CD, Automation

1. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
AWS Secrets Manager - Best
Practices & Use cases
Vijaya Nirmala Gopal

2. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Vijaya Nirmala Gopal (Nirmala)
DevOps Solutions Lead - Cloud,
Sonata Software Limited
https://cloudgoddess.blogspot.com/
Ansible Galaxy Contributor

3. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
❏ AWS Secrets Manager Overview
❏ Top security threats with Credentials
❏ Overlooked Risks
❏ Use case for the day
❏ With Infrastructure as Code
❏ For Configuration Management Solution
❏ Logging/Monitoring - Cloudwatch
❏ Auditing - CloudTrail
❏ Notifications - SNS
❏ Quick compare
❏ Extra Bits
Agenda

4. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
AWS Secrets Manager – Key Features
❏ Secret Rotation with KMS
❏ Automatic password generator [aws cli]
❏ Pay as you go; No upfront or setup cost
❏ Fine grained access using IAM policies
❏ Use secrets for workloads handling
Compliance data like HIPPA, PCI-DSS, ISO/xxx
❏ Audit/Monitor Secrets in AWS

5. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Overlooked Risks ???
Shared by Teri Radichel, CEO, 2nd Sight Lab, AWS Community Hero

6. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved.

7. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Shared by Teri Radichel, CEO, 2nd Sight Lab, AWS Community Hero
❏ Risk Assessments shows below reasons against
credentials misuse
❏ Open network ports
❏ Broad permissions for Application(s)
❏ Wider privileges for IAM user
❏ Unprotected keys and credentials

8. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Use case - AWS Secrets Manager

9. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
AWS Secrets Manager - Permissions
Essential Permissions – AWS SM

10. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
AWS Secrets Manager - AWS CLI
Creation & Retrieval of secrets

11. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Infrastructure provisioning - Use cases
How efficient is secrets with Cloudformation
● Use resolve tag to fetch or refer the secrets from Secrets Manager
{{resolve:secretsmanager:secret-id:secret-string:json-key:version-stage:version-id}}
“MasterPassword”: ‘{{ resolve:secretsmanager:RDS-master-password:SecretString:password}}’

12. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Infrastructure provisioning - Use cases
How efficient is secrets with Terraform
● Use terraform module ‘aws_secretsmanager_secret’ and
‘aws_secretsmanager_secret_version’ create secrets
● Use output to view the secrets
● AWS CLI for fetching the secrets in user_data

13. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Configuration Management - Use cases
How secrets fit with Ansible
❏ Ansible aws_secret - Lookup plugin for
secrets manager
❏ Use & register with CLI

14. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Configuration Management - Use cases
Fetch using AWS CLI

15. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Configuration Management - Use cases
Fetch using API(ex. Python)

16. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
AWS Secret Manager – with Lambda
Fetch and use with Lambda

17. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Auditing Secrets Usage - CloudTrail

18. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
CloudTrail - Delete
❏ what happens on Delete
❏ Be known to mischievous actions
❏ Take back the decision in 7 days
❏ Check integrity by running regressions

19. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Monitoring/Logging Secrets - CloudWatch
❏ API calls made
❏ Access error messages
❏ Analyze and action of unused or un-rotated secrets

20. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
SNS - AWS Secrets Manager
Get alerted on actions or customize triggers for alert
❏ On Delete
❏ On permission denied to track suspicious access
❏ API Calls
❏ Other scenarios

21. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
AWS Secrets Manager – Cost Explorer

22. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Comparison with other options
AWS SSM Parameter store
❏ Rotate with custom Lambda
❏ Lambda creation and maintenance
❏ No Cross account access
❏ S3 - In Rest & Transit Encrypted texts
❏ Ansible Vault or Hashicorp
❏ VM or Instance
❏ Custom made mechanism to rotate
AWS Secrets Manager
❏ All secrets are encrypted
❏ Built in Lambda to rotate
secrets
❏ Billed per secret stored and
API calls
❏ Integration password rotation
❏ Random password generation

23. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Step Ahead - git-secrets
Access Keys/Credentials in Git Repos
❏ scrutinize the most valuable targets
❏ prevents keys/credentials anywhere in/into repos
❏ Add as Jenkins job to checkout repos dynamically and
scan and report

24. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Step 1: Clone git-secrets repo into Target Instance(EC2 or VM)
Step 2: Install git-secrets

25. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Step 3: Install register and view patterns
Step 4: Add sample file scan for keys or patterns

26. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Step 5: Block the commits for files not compliant with patterns allowed

27. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Thank you!