Day 17: Managing Secrets with AWS Secrets Manager and Parameter Store

---

Welcome to Day 17 of our exciting "30 Days of AWS" journey! If you've been following along from the beginning, kudos to you for diving into the world of Amazon Web Services. Your dedication and curiosity are truly commendable.

For those who might have just joined us or are specifically interested in today's topic, a warm welcome to you as well! While each article in this series delves into a different facet of AWS, rest assured that they are all interconnected, building upon the knowledge we've been cultivating day by day.

If you're here for the first time, I encourage you to take a moment to catch up on our previous discussions. This will enhance your understanding and ensure a seamless flow as we dive deeper into the fascinating journey of AWS together.

In today’s installment, we will explore "Managing Secrets with AWS Secrets Manager and Parameter Store." Whether it’s database credentials, API keys, or sensitive configuration details, every application has some information that needs to be kept secure. AWS offers two powerful services to manage and protect such sensitive data: Secrets Manager and Parameter Store.

As always, feel free to engage, ask questions, and share your thoughts in the comments. Your participation is what makes this series vibrant and valuable. I’m thrilled to have you join us on this journey. Let’s get started!

What is AWS Secrets Manager?

Let’s begin with a technical definition:

AWS Secrets Manager is a managed service that helps you securely store, manage, and retrieve sensitive information (such as database credentials, API keys, and tokens) without hardcoding them in your application. Secrets Manager also automatically rotates the secrets, ensuring that they stay up-to-date and secure.

To put it in a simple way:

Think of AWS Secrets Manager as a digital vault where you can safely store your important items like passwords, just like a safe deposit box in a bank. Every time you need a secret (like an API key), you go to the vault and retrieve it securely. Secrets Manager also has the option to rotate the lock of the vault periodically, ensuring no one else gets hold of your secret key.

Why Use AWS Secrets Manager?

1. Secure Storage:
   Secrets Manager encrypts sensitive data using AWS KMS (Key Management Service) to keep it secure.

2. Automatic Rotation:
   Secrets Manager can automatically update secrets, such as database passwords, without affecting your application’s access.

3. Access Control:
   You can use IAM policies to specify who can access and modify the secrets.

What is AWS Systems Manager Parameter Store?

Here’s the technical definition:

AWS Systems Manager Parameter Store is a service that provides secure storage for configuration data and secrets management. It supports both plain text parameters (like configuration settings) and encrypted parameters (like API keys and database credentials).

To put it in a simple way:

Imagine Parameter Store as a notebook where you jot down all your important notes (configuration data) and sensitive details (API keys). There are two types of notes:

1. Simple notes (plain text) for regular information.

2. Secret notes (encrypted) that are locked with a special code.

Whenever your application needs to look up a value, it just checks this notebook and retrieves the exact value securely.

Why Use Parameter Store?

1. Centralized Management:
   Store configuration settings, paths, and secrets in a single place.

2. Supports Both Secure and Non-Secure Values:
   You can use it for simple configuration settings (like environment variables) or sensitive data (like API keys).

3. Integration with AWS Services:
   Parameter Store integrates with services like Lambda, EC2, and ECS, allowing you to securely access values without hardcoding them in your application.

When to Use Secrets Manager vs. Parameter Store?

Both services are designed to manage secrets, but they serve slightly different purposes:

1. Use Secrets Manager if you need automatic rotation for secrets like database passwords and API tokens, and require detailed auditing or custom key rotation.

2. Use Parameter Store if you need a centralized location for both configuration data and sensitive information, or want a simpler, cost-effective option for storing secrets.

Key Differences:

Setting Up AWS Secrets Manager and Parameter Store: A Step-by-Step Guide

Let’s create and use a database password in both AWS Secrets Manager and Parameter Store.

Step 1: Creating a Secret in AWS Secrets Manager

1. Go to the Secrets Manager Console.

2. Click on Store a New Secret.

3. Select Credentials for RDS Database and enter a username (e.g., admin) and a password (e.g., mypassword123).

4. Choose an RDS instance if you have one, or select Other Type of Secret.

5. Click Next and give your secret a name (e.g., MyDatabaseSecret).

6. Set up Automatic Rotation (optional) if you want the password to update automatically.

7. Click Store.

Step 2: Retrieve the Secret Using the CLI

Open your terminal and run the following command:

aws secretsmanager get-secret-value --secret-id MyDatabaseSecret

This command will show you the stored password.

Step 3: Creating a Parameter in Parameter Store

1. Go to the Systems Manager Console.

2. Click on Parameter Store → Create Parameter.

3. Set the Name to /myapp/database/password.

4. Choose Type: SecureString.

5. Enter a value (e.g., mypassword123).

6. Click Create Parameter.

Step 4: Retrieve the Parameter Using the CLI

Open your terminal and run the following command:

aws ssm get-parameter --name "/myapp/database/password" --with-decryption

This command will show you the stored parameter value.

Best Practices for Managing Secrets

1. Use Secrets Manager for Sensitive Data:
   Store database credentials, API keys, and tokens in Secrets Manager with automatic rotation enabled.

2. Use Parameter Store for Configuration:
   Store application configurations, feature flags, and environment variables in Parameter Store.

3. Control Access Using IAM Policies:
   Restrict access to your secrets and parameters using IAM roles and policies to prevent unauthorized access.

4. Enable Logging and Monitoring:
   Use CloudTrail to track who accessed your secrets and when.

Summary

Today, we explored:

• What AWS Secrets Manager and Parameter Store are and how they help manage secrets.

• The key differences between these two services.

• Setting up secrets in both services and retrieving them using the CLI.

What’s Next?

In Day 18, we’ll dive into AWS CloudTrail and AWS Config to learn how to monitor and audit your AWS resources. We’ll explore how to track changes, maintain compliance, and get alerts when something goes wrong.

Stay tuned, and let’s keep this AWS learning journey going strong!

---

Hope you find this blog helpful. Please share your thoughts in the comments—it will help me refine and provide more insightful content. Happy Learning!

Connect with Me - LinkedIn - Twitter/X - Topmate