Strongbox: a secret manager for AWS

Re:Strongbox: a secret manager for AWS by stiankri on Monday November 27, 2017 @10:42AM (#15788131)

That is certainly one approach we have looked at. The question then is where would you run the REST API? As a side car, as a separate service, e.g. using AWS API Gateway and Lambdas?

If you look at the work required to write a simplified read-only client using the AWS SDK for KMS and DynamoDB, while perhaps a bit more work than integrating with a REST API, it is not that far off, which is why we are considering that approach. That would of course not help if you are using a language that does not have an AWS SDK.

[ Parent | on HN ]

Re:Strongbox: a secret manager for AWS by rad_gruchalski on Monday November 27, 2017 @05:12PM (#15792051)

All AWS SDKs use the underlying REST(ey) API. The SDKs are literally machine generated. I can download the WSDLs or take these files https://github.com/aws/aws-sdk-go/tree/master/models/apis and generate one myself.

[ Parent | on HN ]

Re:Strongbox: a secret manager for AWS by auspex on Monday November 27, 2017 @01:26PM (#15789725)

Any of the suggestions above would most likely work. Running an API sidecar or separate service would just be the cost of exposing the REST API.

I could definitely envision people deciding against using your key store when comparing to something like Vault based just on the fact that you limit extensibility with no API.

[ Parent | on HN ]