How to securely pass secrets from step to step in step functions

I'd like to define a step that extracts secrets from secrets manager and then passes those secrets to another step. With logging enabled the secrets are logged as input to the next step. If I disable logging payloads, then other step's payload are also not logged. Is there a way to protect secrets between steps and still log other information?

주제

서버리스 애플리케이션 통합 DevOps 마이크로서비스 보안, 신원 및 규정 준수

태그

AWS 단계 함수 DevOps 마이크로서비스 AWS 시크릿 관리자

언어

English

Jammor

질문됨 2년 전1740회 조회

2개 답변

최신
최다 투표
가장 많은 댓글

이 답변이 도움이 되었나요?커뮤니티가 여러분의 지식을 활용할 수 있도록 정답을 찬성하세요.

Could you pass the secret-id(s) and let the next step pull them from Secrets Manager?

전문가

kentrad

답변함 2년 전

Jammor
2년 전
The step is a call to CallAwsService with secretsManager as the service. Its not a lambda. I'm mostly curious if AWS has solved this issue via the step function infrastructure to pass secrets between steps; and that I had missed how to do it. Without that functionality its not really a sate machine its just a call stack.

I would recommend to retrieve the secrets in the steps you need them, or, encrypt the secrets where you retrieve them and then decrypt where needed. You will need to have some shared encryption key between these steps, so I am not sure it gets you anything.

전문가

Uri

답변함 2년 전

Jammor
2년 전
As I mentioned to kentrad: The step is a call to CallAwsService with secretsManager as the service. Its not a lambda. I'm mostly curious if AWS has solved this issue via the step function infrastructure to pass secrets between steps; and that I had missed how to do it. Without that functionality its not really a sate machine its just a call stack.

How to securely pass secrets from step to step in step functions

관련 콘텐츠