Strongbox: a secret manager for AWS

why not just use parameter store? <a href="https:&#x2F;&#x2F;aws.amazon.com&#x2F;ec2&#x2F;systems-manager&#x2F;parameter-store&#x2F;" rel="nofollow">https:&#x2F;&#x2F;aws.amazon.com&#x2F;ec2&#x2F;systems-manager&#x2F;parameter-store&#x2F;</a>. Plus: don&#x27;t use credentials directly, use the assume role feature.

The comparison with Vault is somewhat misleading.<p>- There are several free UIs available for Vault like <a href="https:&#x2F;&#x2F;github.com&#x2F;djenriquez&#x2F;vault-ui" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;djenriquez&#x2F;vault-ui</a>, they just aren&#x27;t provided by Hashicorp<p>- I&#x27;m not sure what &quot;file secrets&quot; might refer to other than storing the contents of a file, for which Vault&#x27;s CLI provides shortcuts.<p>- While Vault&#x27;s generic k&#x2F;v backend doesn&#x27;t support purging expired values in order to avoid accidental data loss, there are plenty of other backends that integrate with AWS STS, Postgres, etc. to provide dynamic, short-lived credentials.<p>- I&#x27;m not sure how Vault doesn&#x27;t support encrypted backups seeing as the data is already encrypted on disk. Take EBS snapshots or something.<p>- Versioning of secrets is a popular request and Hashicorp has some &quot;vague plans&quot; which is an improvement from &quot;no plans.&quot; <a href="https:&#x2F;&#x2F;github.com&#x2F;hashicorp&#x2F;vault&#x2F;issues&#x2F;1364#issuecomment-328251464" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;hashicorp&#x2F;vault&#x2F;issues&#x2F;1364#issuecomment-...</a><p>Plus you get a full REST API, a ton of auth methods, granular access policies, etc.

Hi, this really needs a REST API.<p>Most secrets are injected in real time at the startup of of a container. For tools like this or plugins in k8 &#x2F; docker to access your store you should support this. It&#x27;s really bad practice to create a hard dependency on your secrets store by using the Java sdk directly in your application. If that&#x27;s not the intent definitely provide a Golang sdk for proper plugin integration.<p>Can you explain how secrets are injected now?

I&#x27;m the creator of Strongbox. Feel free to ask me technical questions about the project.

If you&#x27;re all in on AWS, just use parameter store. This scheme is just CredStash, and so is parameter store under the hood.

Charging $1 per secret is interesting. I wonder if that will affect how people design their application.<p>We&#x27;ve had a pretty splendid experience with Vault so far, so I&#x27;m not exactly in the market for another solution, but this looks interesting.<p>I assume you started development on this because Vault et al didn&#x27;t exist yet at the time? Or was there another driver?

There&#x27;s also <a href="https:&#x2F;&#x2F;www.envkey.com&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.envkey.com&#x2F;</a>

If you&#x27;re comfortable with using KMS already, I recommend checking out SOPS: <a href="https:&#x2F;&#x2F;github.com&#x2F;mozilla&#x2F;sops" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;mozilla&#x2F;sops</a><p>It can be versioned if you use git, access controlled via the KMS access privileges, and easily plugs into other tools because it uses YAML. Simplicity is the killer feature.

How does SecretBox compare with Vault [0] or BlackBox [1]?<p>[0] <a href="https:&#x2F;&#x2F;github.com&#x2F;hashicorp&#x2F;vault" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;hashicorp&#x2F;vault</a><p>[1] <a href="https:&#x2F;&#x2F;github.com&#x2F;stackexchange&#x2F;blackbox" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;stackexchange&#x2F;blackbox</a>

Current parameter store user - one feature not mentioned in the comparison is the fact that accessing &#x2F; updating a secret in parameter store will show up in Cloudtrail. Is there a similar audit trail in strongbox?

I prefer the RBAC and YAML policies Conjur provides... <a href="https:&#x2F;&#x2F;github.com&#x2F;cyberark&#x2F;conjur" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;cyberark&#x2F;conjur</a>