TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

AWS Secrets Manager Agent

112 点作者 plurby10 个月前

15 条评论

WatchDog10 个月前
So the point of this is just to cache secrets, to avoid caching them in your app memory?<p>Seems like kinda a niche threat model, if your app is already compromised to the point where it&#x27;s secret cache can be read, it seems likely that the attacker could also pivot to just read from the cache, or use the instance credentials to read from secrets manager itself.
评论 #40945920 未加载
评论 #40943156 未加载
评论 #40945952 未加载
评论 #40947105 未加载
评论 #40945443 未加载
评论 #40945716 未加载
评论 #40942751 未加载
derefr10 个月前
Why are all the various &quot;secrets vault&quot; approaches so splintered and proprietary, anyway? Why is there a separate tool I have to install for:<p>• AWS secrets, GCP secrets, Azure secrets... each has its own API<p>• secrets in a HashiCorp Vault install<p>• secrets from whatever cloud password manager<p>• &quot;ambient&quot; secrets from env-vars, or the local .netrc, or the local macOS Keychain<p>• k8s Secrets resources (when you&#x27;re a k8s CRD controller)<p>• secrets stored in SOPS files, in turn encrypted by keys held in any of the above<p>Why haven&#x27;t we seen a generic &quot;secrets client&quot; library, with pluggable adapters for handling all of these cases through the same library API &#x2F; CLI tooling?<p>Or better yet, why not a generic <i>stub</i> secrets client, that speaks to an also-generic &quot;caching middleware proxy&quot; like this AWS one — where the <i>proxy</i> has the pluggable backend adapters + connection config for them?
评论 #40947319 未加载
评论 #40952557 未加载
评论 #40947610 未加载
评论 #40947274 未加载
评论 #40947849 未加载
评论 #40947382 未加载
slaughtr10 个月前
This seems like quite a lot of setup and hassle for what could be handled some other way with less fuss, like chamber[0] or Doppler[1]. Heck, even the classic .env seems like a better choice in every way.<p>What are the advantages to a configuration like this? Seems the HTTP interface with non-encrypted cache and separate agent situation isn’t something secure enough to satisfy most companies these days.<p>[0] <a href="https:&#x2F;&#x2F;github.com&#x2F;segmentio&#x2F;chamber">https:&#x2F;&#x2F;github.com&#x2F;segmentio&#x2F;chamber</a><p>[1] <a href="https:&#x2F;&#x2F;www.doppler.com&#x2F;">https:&#x2F;&#x2F;www.doppler.com&#x2F;</a>
评论 #40942598 未加载
评论 #40942572 未加载
评论 #40943838 未加载
评论 #40947687 未加载
评论 #40947135 未加载
thedougd10 个月前
What I really want is a consul-template for AWS Secrets Manager. As I wrote this I googled and found a plugin:<p><a href="https:&#x2F;&#x2F;github.com&#x2F;chrissav&#x2F;consul-template-plugin-secretsmanager">https:&#x2F;&#x2F;github.com&#x2F;chrissav&#x2F;consul-template-plugin-secretsma...</a><p>I didn&#x27;t realize consul-template supported plugins.
SunnyW10 个月前
For senior developers who are ready to write code, integrating the appropriate AWS SDK library for your programming language and writing a few lines of code might seem straightforward, and may not take more than half a day. However, consider a large company with thousands of applications—like in my case—where this effort is multiplied a thousandfold. Moreover, these applications are developed in over 10 different languages, some of which may not even have an available AWS SDK. Therefore, using an agent that simplifies these operations into a single HTTP call to a sidecar service truly adds value.<p>Another consideration is operation; imagine that there are 10 different libraries maintained for this purpose, and if there is a new feature, say, you need all logs going to one place, making sure it is available in all languages would require a team with different programming skills to do so. Secrets agent, being language agnostic, you only need to change at one place, and someone else may have already done it for it or ready to do it, as it is open source project.<p>When it comes to cost saving, imagine scenarios where a junior developer improperly implements secret retrieval in a Lambda function, with retrieval occurring at every function invocation and each function handling 100 transactions per second. Such a single oversight can cost $1,000 a month, and if left unnoticed for a year—a common occurrence when the function appears to work—people often overlook further scrutiny as long as it functions.
wrs10 个月前
FYI, there is an AWS-provided Lambda layer similar in principle to this, also including access to Parameter Store.<p><a href="https:&#x2F;&#x2F;aws.amazon.com&#x2F;blogs&#x2F;compute&#x2F;using-the-aws-parameter-and-secrets-lambda-extension-to-cache-parameters-and-secrets&#x2F;" rel="nofollow">https:&#x2F;&#x2F;aws.amazon.com&#x2F;blogs&#x2F;compute&#x2F;using-the-aws-parameter...</a>
perryizgr810 个月前
How is this different from calling Secrets Manager directly? The only benefit I can think of is caching. So your secrets can be fetched a bit faster. But that is such a niche use-case, and you can easily cache it yourself if you need to.
评论 #40944795 未加载
评论 #40945151 未加载
micahbule10 个月前
One particular use case that I might try this for is for (very) restrictive environments. One such case was with my previous work where we had to develop services for the client but we can only do it in a remote desktop with certain network and application restrictions. Instead of having conditions for the environment to load certain config, we can simply retrieve the secrets stored in AWS (ex. RDS credentials) via the agent.
lijok10 个月前
I&#x27;m going to say this as nicely as I can. Secrets Manager can fuck right off with their $.50&#x2F;mo&#x2F;secret pricing.<p>Moved all our secrets to S3 a long time ago and haven&#x27;t looked back.
评论 #40944120 未加载
评论 #40945409 未加载
评论 #40946256 未加载
420official10 个月前
This is really cool, I&#x27;ve been running something similar to simplify rotating database credentials for legacy projects.
webprofusion10 个月前
So a bit like Hashicorp Vault (in that it has a locally accessed secrets store) but backed by AWS Secrets Manager.
symlinkk10 个月前
Who cares? People are only upvoting this because it’s written in Rust. The actual tool seems useless
gtirloni10 个月前
This should come in handy with SOPS and git log.
Sparkyte10 个月前
I got to use secrets manager a while back it was a breath of fresh air as it was all of those things you seeking in vault without all of the problems of it being hashicorp. No offense hashicorp. I rather blame AWS than a self-managed solution.
评论 #40947055 未加载
shironandonon_10 个月前
this feels more like Azure Secrets which has been a superior product.