AWS Secrets Manager / Secrets in GitHub
Axel Forstenhäusler (af096)
Where do you store your secrets?
Why should we use a Secrets Manager?
Github Credentials Leakage
- 100k repositories affected
- almost 2000 new unique keys every day
- 20 seconds to discover a new key
- 89% aren't test keys
- 81% remain longer than 16 days
Demo
Demo
- Endpoint /search/code
- Google API keys always start with "AIza"
Demo
- 2422933 matches
- items array => includes information about the repository and a html_url
Demo
Demo
Private Repository?
- Everyone who has access to the repository can see production keys
- Rotation is difficult when secrets are hard coded (update and redeploy application)
AWS Secrets Manager- How does it work?
Create a secret
Create a secret
Create a secret
Create a secret
Retrieve a secret
- Create a new access key and download it
Retrieve a secret
- Save the key_id and the access_key in ~/.aws/credentials
Retrieve a secret
aws secretsmanager get-secret-value
--secret-id prod/google/api
--version-stage AWSCURRENT- Secret id is the name of the secret
{
"Name": "prod/google/api",
"VersionId": "dd5f7331-a99b-4417-9b42-f5c738e866f4",
"SecretString": "{\"googleApiKey\":\"asd897182kxakaksd\"}",
"VersionStages": [
"AWSCURRENT"
],
"CreatedDate": 1559729811.626,
"ARN": "arn:aws:secretsmanager:us-east-2:254943305144:secret:prod/google/api-lfCYH5"
}Response:
Retrieve a secret
var AWS = require('aws-sdk'),
region = "us-east-2",
secretName = "prod/google/api",
secret,
decodedBinarySecret;
// Create a Secrets Manager client
var client = new AWS.SecretsManager({
region: region
});
client.getSecretValue({SecretId: secretName}, function(err, data) {
if (err) {
throw err;
} else {
if ('SecretString' in data) {
secret = data.SecretString;
} else {
let buff = new Buffer(data.SecretBinary, 'base64');
decodedBinarySecret = buff.toString('ascii');
}
}
// Your code goes here.
});Rotate automatically
- easy for other amazon services like RDS
- Possible for custom services by implementing a lambda function
Help, I leaked a Secret
Help, I leaked a Secret
AWS Secrets Manager
By Axel Forstenhäusler
