SECURING YOUR SECRETS IN AWS

Summary from the TLDR InfoSec newsletter

An exploration of how to incrementally improve credentials access in AWS. The post begins with outlining a “vanilla” credentials workflow before detailing how environment variables do not solve the threats inherent with having plaintext credentials. It then outlines how to store secrets in Secrets Manager and have the application dynamically retrieve them to eliminate plaintext secrets from production. The next improvement comes from using KMS to encrypt secrets before using them in CI/CD pipelines to reduce the presence of plaintext credentials. The post then details steps that service providers can use to improve credential management for customers including bringing your own key.