Database- AWS Secrets Manager

Manage and retrieve database credentials using secret manager and using CloudTrail to monitor it.

Secrets Manager enables us to replace embedded credentials in our code, including passwords, with an API call to Secrets Manager to retrieve the secret programmatically. This ensures the secrets can’t be compromised by anyone examining our code, because the secrets no longer exist in the application code and are independent of the development of the application.
Also, we can configure Secrets Manager to automatically rotate the secret for us according to a specified schedule. This enables us to replace long-term secrets with short-term ones, significantly reducing the risk of compromise.

Que 1- Explain the concepts required to understand AWS Secret Manager.
Ans- The following four concepts are important for understanding how the AWS Secrets Manager works:
Secret, Version, Rotation and Rotation Strategy.

Secret- It consists of secret information, the secret value, plus metadata about the secret. A secret value can be a string or binary. To store multiple string values in one secret, we recommend that you use a JSON text string with key/value pairs, for example:

{
 "host" : "ProdServer-01.databases.example.com",
 "port" : "8888",
 "username" : "administrator",
 "password" : "EXAMPLE-PASSWORD",
 "dbname" : "MyDatabase",
 "engine" : "mysql"
}

A secret’s metadata includes: An Amazon Resource Name (ARN) with the following format:

arn:aws:secretsmanager:<Region>:<AccountId>:secret:SecretName-6RandomCharacters

Version- A secret has versions which hold copies of the encrypted secret value. When you change the secret value, or the secret is rotated, Secrets Manager creates a new version.
Secrets Manager doesn't store a linear history of secrets with versions. Instead, it keeps track of three specific versions by labelling them:

The current version - AWSCURRENT

The previous version - AWSPREVIOUS

The pending version (during rotation) - AWSPENDING

Rotation- Rotation is the process of periodically updating a secret to make it more difficult for an attacker to access the credentials. In Secrets Manager, you can set up automatic rotation for your secrets. When Secrets Manager rotates a secret, it updates the credentials in both the secret and the database or service.

Rotation strategy- Secrets Manager offers two rotation strategies:

Single user This strategy updates credentials for one user in one secret. The user must have permission to update their password. This is the simplest rotation strategy, and it is appropriate for most use cases.

Alternating users This strategy updates credentials for two users in one secret. You create the first user, and during the first rotation, the rotation function clones it to create the second user. Every time the secret rotates, the rotation function alternates which user’s password it updates. Because most users don’t have permission to clone themselves, you must provide the credentials for a superuser in another secret.

Que 2- What can I do with AWS Secrets Manager?
Ans- AWS Secrets Manager enables you to store, retrieve, control access to, rotate, audit, and monitor secrets centrally.
You can encrypt secrets at rest to reduce the likelihood of unauthorized users viewing sensitive information. To retrieve secrets, you simply replace secrets in plain text in your applications with code to pull in those secrets programmatically using the Secrets Manager APIs.

Que 3- How can my application use these secrets?
Ans- Before your application can use, you must write an AWS Identity and Access Management (IAM) policy permitting your application to access specific secrets. Then, in the application source code, you can replace secrets in plain text with code to retrieve these secrets programmatically using the Secrets Manager APIs.

Que 4- How is secret manager priced?
Ans — You pay based on the number of secrets stored and API calls made per month.

Que 5- Explain in brief the use cases of AWS Secrets Manager?
Ans-
• Newer service, meant for storing secrets.
• Capability to force rotation of secrets every X days.
• Automate generation of secrets on rotation (uses Lambda).
• Integration with Amazon RDS (MySQL, PostgreSQL, Aurora).
• Secrets are encrypted using KMS.
• Mostly meant for RDS integration.

Que 6- Does Secrets Manager lets you easily copy your secrets to multiple AWS Regions, which includes the primary secret and the associated metadata such as tags, resource policies and secret updates such as rotation?
Ans- Yes, Multi-Region secrets replication is possible. It does:
• Replicate Secrets across multiple AWS Regions
• Keeps read replicas in sync with the primary Secret
• Has an ability to promote a read replica Secret to a standalone Secret
• Use cases: multi-region apps, disaster recovery strategies, multi-region DB…

Implement

Task:

a) Sign in to AWS Management Console and create RDS MySQL instance.
b) Store a new secret. (say LabSecret)
c) Verify the secret created.
d) Using cloud trail to monitor secret manager activities.

Solution:

a) Sign in to AWS Management Console and create RDS MySQL instance.

Once you are logged in to the console, search for RDS and click on Create database.

In the create database screen, select the following :
Choose a database creation method : Standard create
Engine type : MySQL
Templates : free tier

In settings and DB instance class tab, fill the details as follows :
DB instance identifier : SecretManagerLab (any name)
Master username : admin (any username for your database instance)
Master password : dcVRBrxLbhacVU6 (any password for your instance)
DB instance class : db.t2.micro

Get Sumbul Naqvi’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

Note : Make sure to remember the username and password or simply paste in a text file

In the Storage tab, keep everything as default and make sure to undo the checkbox for Enable storage autoscaling.

In the connectivity tab, make sure that the Public access is set to No.

Keep everything else as default. After this click Create database.
It takes some time for your database to be created.

We create an RDS MySQL instance successfully !

b) Store a new secret.

Search AWS Secret Manager and click on Store a new secret.

Now in Secret type, please select Credentials for Amazon RDS database and enter the following details :
User name : (username of our database instance, here we used admin)
Password : (password of our db instance, here we used dcVRBrxLbhacVU6)
Encryption key : [keep it as default]

Select the database instance you created in the previous step, (named SecretManagerLab) and click next.

On the next screen, give the Secret name as any name (LabSecret ) and keep everything else as default. Click next.

Secret ‘LabsSecret’ has been stored, with Secret Manager. :)

c) Verify the secret created.

Once the secret is created and rotation is configured click on the secret name[LabsSecret]

Now click on the Retrieve secret value button

We can see the details of our secret value including the password. ⬇️

d) Using cloud trail to monitor secret manager activities.

Now, search cloudtrail and in the left navigation tab, click on event history

In the lookup attributes, select Event name and Enter event name as GetSecretValue.

You can see the user name of all the users who tried to access the secret and the event time.

AWS Secrets Manager is a service provided by Amazon Web Services (AWS) that helps you manage and protect sensitive information such as passwords, API keys, and other credentials. It allows you to securely store, access, and rotate these secrets, reducing the risk of unauthorized access and improving overall security for your applications and services.

AWS CloudTrail is an AWS service that helps you enable operational and risk auditing, governance, and compliance of your AWS account. Actions taken by a user, role, or an AWS service are recorded as events in CloudTrail.

Note:

Once you are done with the lab, go back to the RDS and click on Databases on the left navigation panel. Select the created RDS MySQL instance with the name “secretmanagerlab” and click on Actions and then click on Delete.

Thanks,
Happy learning & sharing 😊
Sumbul