Alternatives to Secrets Manager for storing secret keys for EC2 running RDBMS (MariaDB/MySQL/PostgreSQL)

Question

We looking into storing RDBMS credentials with an alternative method than Secrets Manager, due to cost reasons and and a legacy implementation.

Business wants to keep it lightweight, automated, and resembling Secrets Manager, but they want a custom solution to be coded.

We are not concerned with unauthorized EC2 access from Internet because of the architecture (VPC with no attached IGW), but we need to keep the DB credentials unreadable for the naked eye (legacy reasons for the implementation), in this case support engineers who are working on the servers.

So far we have looked into:
- OpenSSL with key based symmetric ciphers, but that still requires a plaintext password.
- gpg encrypted files.

What are your experiences when asked (management) to stop using Secrets Manager and find an alternative solution in *IX based EC2 instances, with the main requirements being "unreadable to the naked eye" and "do not use AWS Secrets Manager"?

Brandon Ancelin · Accepted Answer

Have you checked SSM Parameter Store ?  
Free to use, integrated with IAM, possibilities to create SecureString meaning that you can encrypt your secrets with a KMS key, as you can do with Secrets Manager.

It’s really close to Secrets Manager, maybe it might works for your use case if you still want to use a native AWS solution.
[Parameter Store documentation](https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-parameter-store.html)

Alternatives to Secrets Manager for storing secret keys for EC2 running RDBMS (MariaDB/MySQL/PostgreSQL)

Add your answer

Relevant content