AWS Secret Manager best Practice

Question

I have having a spring boot dockerize application running inside fargate cluster.This is application uses aurora DB. I want to store DB password and API key in AWS Secret Manager.My idea was to make a API from Application and fetch the secret from secret maneger. But architect is saying this is not best approach.

What would be other better ways to achieve this ?

It is a good approach, you should be able to ask your architect why he/she thinks it is not the best appraoch. — Juned Ahsan, Dec 06 '19 at 05:15

score 3 · Answer 1 · answered Dec 06 '19 at 22:57

ECS provides a tutorial for specifying sensitive data to your cluster using Secrets Manager: https://docs.aws.amazon.com/AmazonECS/latest/userguide/specifying-sensitive-data-tutorial.html.

As for database credentials, if your application is written in Java, the best way to provide rotation-safe credentials to your application is to use the AWS-provided JDBC client library: https://github.com/aws/aws-secretsmanager-jdbc. Then you can safely setup rotation on your database credentials since the library will automatically pull from Secrets Manager and retry connections on authentication failures.

Secrets manager is the right place to store the API key, but for the database credentials there is no need to set up a password at all. Use IAM authentication instead. — Ben Whaley, Dec 07 '19 at 15:16

score 2 · Answer 2 · answered Dec 06 '19 at 04:31

2

You'll want to use IAM Database authentication. Assign an IAM role to your Fargate task with permissions to access your Aurora cluster and voila! No password required.

answered Dec 06 '19 at 04:31

Ben Whaley

32,811
7
87
85

ServerMonkey · Answer 3 · 2019-12-09T02:07:39.573

1

Have you looked into making your code call the Secrets Manager API directly? I wouldn't suggest building an API when one already exists, this can also be used to handle rotated credentials.

Starting point: AWS Java SDK Documentation

edited Dec 09 '19 at 02:07

answered Dec 06 '19 at 04:32

ServerMonkey

1,042
3
19
42

AWS Secret Manager best Practice

3 Answers3