sneaker

This write-up is solid - but man, this product looks questionable. 40 cents per secret per month? With Credstash[0] or a moral equivalent[1] you pay a buck for a KMS key and microcents for the data storage. RDS rotation is...fine, I guess, if you have an auditor who really wants that and can't write a scheduled job for the task (I've been using one with credstash so long it's just an automatic part of a new environment), but it's got me skeptical. Something AWS could do, and I'd be very interested in, is a hosted moral equivalent to Vault. Give me a daemon or something to run on an instance, allow me to IAM-gate temporary SSH credentials (and chuck it in CloudTrail) and temporary SQL databases, and that I'd pay for 'cause I really don't want to deal with Vault or HashiCorp. But AWS Secrets Manager, by itself, doesn't really present a good

Not applicable for y'all, but for our AWS people, I'll cape up for Credstash[1] (or its moral equivalent, Sneaker[2], but I prefer the use of a Dynamo table to S3 for this). Uses IAM to ensure secret access and offers revisioning. Plus it's super easy to work with. My normal stack, using my own Auster[3] for orchestration, uses an offline, file-based secrets store (usually an encrypted USB key in production) for stuff like database root passwords that don't need to be online, then push database passwords into Credstash with encryption contexts (the KMS thing that makes IAM effective for this). My Chef cookbooks happily slurp in credstashed secrets via rcredstash, now that the PR to make it work with parameterized KMS keys has hit, and provisioning is very straightforward. (There are a lot of proper nouns in this paragraph, but the nice th

Any idea if Kickstarter looked at secret store alternatives such as Square Keywhiz[1] or Sneaker[2]? [1] https://square.github.io/keywhiz/ [2] https://github.com/codahale/sneaker

We initially looked around, and here are a few alternatives: - Azure Key Vault: https://azure.microsoft.com/en-us/services/key-vault/ - Blackbox: https://github.com/StackExchange/blackbox - CredStash: https://github.com/fugue/credstash - Lyft Confydant: https://github.com/lyft/confidant - Trousseau: https://github.com/oleiade/trousseau - Sneaker: https://github.com/codahale/sneaker Some of these didn't exist when we were first investigating proper secret management, while others didn't fit as well with our deployment strategy. We're using what works when it makes sense - Blackbox is used in some repos, for instance - but I'll be sure the next time we have an internal doc like this that we cover why we didn't choose a different set of tools. One thing we liked about Vault is that it built upon our usage of Consul a

This is also similiar to Sneaker (https://github.com/codahale/sneaker), which is written in Go. It doesn't copy to other regions by default, but it's not hard to handle that on your own. This also uses KMS, but stores encrypted secrets in S3.

Encrypted S3 is definitely an option. The difficulty there is how to manage secrets that may be shared across services and how to ensure that there's no race conditions between updates of secrets. Confidant provides access to credentials by IAM role. The key here is that you can have credentials A, B, and C, and IAM roles example1-production, example2-production and example3-production, then map credentials A and B to example1-production, A and C to example2-production and A to example3-production. Confidant just stores mapping info for this. If you update A, you don't need to fan out an update to all three services. Race conditions can come in when A and B or C are updated at the same time. S3 is very eventually consistent and there's no locking. read-after-write consistency is only available in one region at this point. Of course, this

So they basically reinvented this? https://github.com/codahale/sneaker

Coincidentally Coda Hale's sneaker (https://github.com/codahale/sneaker) just popped up in my Twitter feed earlier. Sneaker stores the secrets on S3. Keywhiz stores the secrets in a central database and then ephemerally on the client servers. I guess if you started with something like sneaker on AWS using Amazon's KMS you could then move to Keywhiz if you eventually moved out of AWS.