Secrets Manager structure in AWS

Question

Hello everyone I am implementing Secrets manager to my web app and I manage several shared secrets across multiple environments, with some secrets used in more than one. and I was worried about the structure and which one to use?
* One value per secret.
* Multiple values grouped by service per secret.

I don't know which one to use, since AWS does not provide a direct answer (At least to what I could find). However AWS brags that secrets manager has fine grained access control, So I guess I should use one value per secret (unless we are talking about username and password) then we can group these two values in one secret.

I want to hear your opinion, and would like to know which is the best practice.

Thank you!

Didier Durand · Accepted Answer

Hi,

I think that this prescriptive guidance about SM best practices is what you need: https://docs.aws.amazon.com/prescriptive-guidance/latest/secure-sensitive-data-secrets-manager-terraform/best-practices.html

I really advise you to read all its aspects end to end to create the right security architecture

Re number of secrets: it's better to have only 1 value per secret because of the "least knowledge" security principle. Secrets that are joint today might have to be separated tomorrow.

The guidance above will also propose you some ways to be efficient: hierarchical secret naming, etc.

Finally, I'd suggest to read the Security section of AWS Well Architected: in particular, the one about secrets at https://docs.aws.amazon.com/wellarchitected/latest/framework/sec_identities_secrets.html

Best,

Didier

Secrets Manager structure in AWS

Add your answer

Relevant content