Secrets Manager

Credential Retrieval

SSM facilitates the removal of hardcoded credentials from application source code or configuration files, replacing them with calls to the Secrets Manager API. This enables dynamic retrieval and management of credentials programmatically, thus mitigating potential leaks of sensitive information due to code or access vulnerabilities.

Encrypted Credential Storage and Transfer

SSM allows for the storage of various types of sensitive data as name-value pairs, with the value part accommodating up to 4,096 bytes of information such as database connections, account passwords, and IP ports. Utilizing a Customer Master Key (CMK) protected by Key Management Service (KMS), SSM encrypts the stored sensitive data. When a credential is requested, it is securely transferred to the local server over TLS, ensuring data security during transmission.

Application-Layer Credential Rotation

SSM streamlines the process of rotating and managing secrets by routinely updating credential content within the system. Additionally, it automatically synchronizes credential updates across all applications, ensuring that applications consistently utilize the latest version of secrets and maintaining seamless business operations.

Resource-level Access Authorization

SSM seamlessly integrates with CAM, enabling secure and granular management of access permissions for sensitive credentials. With CAM, users can create SSM users or roles, designate authorized users to access specific credentials within SSM, and regulate permissions for credential-related operations, including viewing, modifying, and deleting, using finely-tuned access policies.

Refined Regulation and Audit

SSM is fully integrated with CloudAudit, offering comprehensive monitoring, compliance checks, and auditing functionalities for your account. It meticulously logs all credential management operations and usage, capturing key details such as user identities, timestamps, dates, and API actions. These logs can be securely stored and transferred to a designated COS bucket for further analysis and auditing purposes.

Compliance Requirements:

SSM collaborates with KMS, leveraging an HMS authenticated by a third party to generate and safeguard keys, ensuring adherence to regulatory and compliance standards.

High-Availability Disaster Recovery and Backup:

SSM employs cluster deployment and a distributed database storage system for data storage and disaster recovery purposes. It enables the creation of identical credentials across multiple regions to facilitate cross-region disaster recovery. In the event of a cluster failure, a seamless region switch is all that’s required.

Technical Application:

For an agile business, effectively leveraging various sensitive account details such as tokens, certificates, SSH keys, and API keys is imperative. SSM offers a streamlined solution for managing, storing, and retrieving these sensitive credentials throughout their lifecycle.

Use Cases:

Managing lifecycle operations entails encrypting, storing, and querying sensitive configuration data and credentials across multiple applications.

Challenges:

Organizations face the complexity of distributing a large number of sensitive credentials across different departments and systems, lacking centralized management tools.

Solution:

By integrating SSM with CAM and CloudAudit, organizations can comprehensively manage the entire lifecycle of credentials. Sensitive credentials can be effortlessly created, stored, and managed via the console, SDK, or TCCLI.

In typical technical applications, sensitive authentication data like passwords, tokens, certificates, and API keys are often stored directly in plaintext within configuration files, posing inherent security vulnerabilities. With the adoption of Secrets Manager (SSM), such risks associated with embedding sensitive data can be effectively mitigated.

Application Scenarios

SSM is particularly useful for managing various credentials such as database access credentials, API keys, and account passwords.

Challenges Faced
The practice of hardcoding sensitive credentials and storing them in plaintext format presents significant security challenges.

Proposed Solution
A recommended approach involves replacing hardcoded credentials, including passwords, within the codebase with calls to the Secrets Manager API for dynamic retrieval of credentials programmatically. This ensures that sensitive information is not exposed to individuals who may access the code, as the codebase no longer contains any sensitive data.

Technical Application:

Enhancing system security involves regularly updating sensitive credentials.

Use Cases:

Implementing application-layer credential rotation.

Challenges:

Ensuring the synchronization of credential updates across multiple applications/configurations. Manual updates may result in oversight, leading to potential business disruptions.

Solution:

Credentials can be updated via the SSM Console or API. Users can choose between full or partial rotation to synchronize credential updates across all applications effectively.