#Aws secret management how to

You can use AWS CloudFormation StackSets to enable AWS Config and provision rules across accounts and regions as described here. NOTE: You must enable AWS Config and the AWS Config managed rules specific to secrets in all accounts and regions that you want to monitor before creating the aggregator. AWS Organizations helps you centrally govern your environment as you grow and scale your workloads on AWS.

#Aws secret management how to

Next, I’ll show you how to use the AWS Config Aggregator to review how secrets are configured across all accounts and regions in your AWS Organization so you can see whether they’re in compliance with your organization’s security and compliance requirements. Under Resource types to record, turn on recording for all resources by checking the All resources box next to Record all resources supported in this region, as shown in Figure 1 below.įigure 7: Detailed view of rule with noncompliant secretĮxample 2: Drive security compliance across multiple AWS accounts in your AWS Organization by creating an AWS Config Aggregator From the AWS Config console, navigate to Settings and ensure that Recording is on.Use the new managed rule secretsmanager-rotation-check to verify whether your secrets are configured for automatic rotation. Many organizations require regular secret rotation. Example 2: Drive compliance with your security standards across multiple AWS accounts by creating an AWS Config Aggregator, which allows you to collect configuration and compliance data from multiple accounts across multiple regions.Įxample 1: Drive rotation adoption by identifying secrets that aren’t configured for rotation in a single account and region.This maps to the first managed rule listed above. Example 1: Drive rotation adoption by identifying secrets in a single account that aren’t configured for rotation.In this blog post, I walk you through two ways to use AWS Config rules to determine if your organization’s secrets are being managed in compliance with your security requirements:

secretsmanager-scheduled-rotation-success-check: Checks whether or not secrets present in AWS Secrets Manager configured for rotation have been rotated within their rotation schedule.

This rule also supports the maximumAllowedRotationFrequency parameter which, if specified, will compare the secret’s configured rotation frequency to the value set in the parameter.

secretsmanager-rotation-enabled-check: Checks whether or not secrets present in AWS Secrets Manager are configured for rotation.

Once enabled, these rules will trigger every time a secret’s configuration changes. You can also leverage two new AWS Managed Config Rules to evaluate if your secrets’ configuration is in compliance with your organization’s security and compliance requirements, identify secrets that don’t conform to these standards, and receive notifications about them via Amazon Simple Notification Service (SNS). You can now use AWS Config to track changes to secrets’ metadata - such as secret description and rotation configuration, relationship to other AWS sources such as the KMS Key used for secret encryption, Lambda function used for secret rotation, and attributes such as tags associated with the secrets. The service enables you to easily rotate, manage, and retrieve database credentials, API keys, and other secrets throughout their lifecycle.ĪWS Key Management Service and AWS Secrets Manager are primarily classified as 'Data Security Services' and 'Secrets Management' tools respectively.On April 20th, AWS Config announced support for AWS Secrets Manager, making it easier to track configuration changes to the secrets you manage in AWS Secrets Manager. AWS Secrets Manager helps you protect secrets needed to access your applications, services, and IT resources. AWS Key Management Service is also integrated with AWS CloudTrail to provide you with logs of all key usage to help meet your regulatory and compliance needs AWS Secrets Manager: Store, Distribute, and Rotate Credentials Securely. AWS Key Management Service is integrated with other AWS services including Amazon EBS, Amazon S3, and Amazon Redshift. AWS Key Management Service (KMS) is a managed service that makes it easy for you to create and control the encryption keys used to encrypt your data, and uses Hardware Security Modules (HSMs) to protect the security of your keys. AWS Key Management Service vs AWS Secrets Manager: What are the differences?ĪWS Key Management Service: Easily create and control the encryption keys used to encrypt your data.