How to securely pass secrets from step to step in step functions
I'd like to define a step that extracts secrets from secrets manager and then passes those secrets to another step. With logging enabled the secrets are logged as input to the next step. If I disable logging payloads, then other step's payload are also not logged. Is there a way to protect secrets between steps and still log other information?
Could you pass the secret-id(s) and let the next step pull them from Secrets Manager?
I would recommend to retrieve the secrets in the steps you need them, or, encrypt the secrets where you retrieve them and then decrypt where needed. You will need to have some shared encryption key between these steps, so I am not sure it gets you anything.
As I mentioned to kentrad: The step is a call to CallAwsService with secretsManager as the service. Its not a lambda. I'm mostly curious if AWS has solved this issue via the step function infrastructure to pass secrets between steps; and that I had missed how to do it. Without that functionality its not really a sate machine its just a call stack.
Relevant questions
Trigger Step Function with API Gateway and use Fargate within Step Function?
asked a month agoEnvironment variables for a Node app running on an EC2 Instance
asked 5 months agoAWS Step Function Output for container services
asked 5 days agoStep functions pass input into Fargate instance :
asked 2 months agoHow to securely pass secrets from step to step in step functions
asked 3 months agoSecrets Manager rotation intermittent timeout
asked a month agossm secret password automation in aws
asked 4 months agoDo we need Lambda extensions for accessing AWS Secrets Manager ?
asked 14 days agoSecrets get mounted on pods volume but didn't get created after that. Using AWS csi driver.
asked a month agoAccess secrets from secrets manager into the code the running EC2 docker
asked 22 days ago
The step is a call to CallAwsService with secretsManager as the service. Its not a lambda. I'm mostly curious if AWS has solved this issue via the step function infrastructure to pass secrets between steps; and that I had missed how to do it. Without that functionality its not really a sate machine its just a call stack.