4

I'm beginning to work with Secrets Manager and created my first secret in AWS. During the process, it gave me some sample code to work with. I put that in a small application and ran it. The code:

String region = "us-east-1";
string secret = "";

MemoryStream memoryStream = new MemoryStream();
IAmazonSecretsManager client = new AmazonSecretsManagerClient(
                           RegionEndpoint.GetBySystemName(region));

GetSecretValueRequest request = new GetSecretValueRequest();
request.SecretId = "MySecretNameExample";

GetSecretValueResponse response = null;
response = client.GetSecretValue(request);

The problem is that:

  1. I was able to successfully retrieve the secret that I created and
  2. nowhere am I creating a Credentials object with any valid AWS credential data

Where is this code getting the credential information from?

ℛɑƒæĿᴿᴹᴿ
  • 4,983
  • 4
  • 38
  • 58
coach_rob
  • 877
  • 13
  • 28

2 Answers2

5

If you refer to the documenation for the API for this line of code:

IAmazonSecretsManager client = new AmazonSecretsManagerClient(
    RegionEndpoint.GetBySystemName(region));

AmazonSecretsManagerClient

You will find the following description:

Constructs AmazonSecretsManagerClient with the credentials loaded from the application's default configuration, and if unsuccessful from the Instance Profile service on an EC2 instance.

This means that you are either running on an EC2 or ECS service (or related service such as Beanstalk, ...) with a role assigned to the instance or your have configured your credentials in the standard method in a credentials file. The AWS SDK is helping you locate credentials.

This document link will explain in more detail how AWS credentials are managed and selected.

Working with AWS Credentials

I have seen a lot of developers get the little details wrong with how credentials work and how they are used within the SDKs. Given that AWS credentials hold the keys to the AWS kingdom, managing and protecting them is vitally important.

Community
  • 1
  • 1
John Hanley
  • 74,467
  • 6
  • 95
  • 159
4

The AWS SDK uses the a resolution strategy that looks in a number of locations until it finds credentials it can use. Typically the DefaultProviderChain class is responsible for performing the resolution. More information is here, but the gist is the lookup is performed in the following order (for Java, other languages are similar):

  • environment variables
  • Java system properties
  • credentials file (e.g. in the home directory)
  • instance profile credentials (only available when running in AWS)

When you run within AWS infrastructure, you can assign a profile or role to the resource that's running your code. Doing that makes credentials automatically available to your code. The idea is that they've made it easy to avoid putting credentials directly into your code.

Chris Thompson
  • 35,167
  • 12
  • 80
  • 109
  • I went through the provided link for 'Default Credential Provider Chain'. Our application is running 2 ways. 1. docker with EC2 2. ECS with Fargate. 1. if the application running on docker inside EC-2, how to perform the configuration ? (without using any physical files inside the container – Ruchira Kariyawasam Oct 24 '18 at 08:50
  • 1
    @RuchiraKariyawasam see this question https://stackoverflow.com/questions/22409367/fetching-aws-instance-metadata-from-within-docker-container – Chris Thompson Oct 24 '18 at 20:49
  • Thank you. Yes, if the roles assign to EC-2 or ECS, then either instance or docker can able to access AWS metadata service. – Ruchira Kariyawasam Oct 26 '18 at 05:26