Managing Build and Deployment Secrets

This guide covers the critical strategies for securing sensitive information—such as database credentials, API keys, and OAuth tokens—within the AWS ecosystem, specifically focusing on the distinctions between AWS Secrets Manager and AWS Systems Manager (SSM) Parameter Store.

Learning Objectives

After studying this guide, you will be able to:

• Differentiate between AWS Secrets Manager and SSM Parameter Store features and pricing.
• Configure automated credential rotation for machine identities.
• Integrate secrets into CI/CD pipelines (CodeBuild, CodeDeploy).
• Implement cross-account secret access and references.
• Choose the appropriate service based on rotation, cost, and complexity requirements.

Key Terms & Glossary

• SecureString: A Parameter Store data type that uses a KMS key to encrypt sensitive text.
• Secret Rotation: The automated process of updating a secret (e.g., a DB password) at regular intervals without manual intervention.
• Machine Identity: Non-human entities (Lambda functions, EC2 instances, CodeBuild projects) that require credentials to access other services.
• Standard vs. Advanced Parameters: The two tiers of SSM Parameter Store; advanced allows larger values and parameter policies (like expiration).

The "Big Idea"

In a modern DevOps environment, Hardcoded Credentials are Technical Debt and Security Risks. The "Big Idea" here is the decoupling of configuration from secrets. By centralizing secrets in a managed vault, you enable Automated Rotation and Granular Auditing, ensuring that even if a build artifact is exposed, the actual credentials remain protected behind IAM policies and encryption keys.

Formula / Concept Box

Hierarchical Outline

• I. Secret Storage Fundamentals
  • Encryption at Rest: Both services utilize AWS KMS for data protection.
  • Access Control: Both rely on IAM Policies for execution roles.
• II. AWS Secrets Manager Deep Dive
  • Automated Rotation: Primary use case for RDS, Redshift, and DocumentDB.
  • Secret Versioning: Uses staging labels (e.g., AWSCURRENT, AWSPREVIOUS).
• III. SSM Parameter Store Deep Dive
  • Hierarchy: Uses path-based naming (e.g., /prod/db/password).
  • Integration: Can reference Secrets Manager secrets directly.
• IV. CI/CD Integration
  • CodeBuild: Referencing secrets in buildspec.yml under the env: secrets-manager or env: parameter-store sections.
  • CodeDeploy: Injecting secrets during deployment hooks.

Visual Anchors

Secret Retrieval Workflow

Data Protection Layers

Definition-Example Pairs

• Parameter Hierarchy: A way to organize parameters using paths to allow for group-based permissions.
  • Example: Storing /dev/app/db_url and /prod/app/db_url allows you to give a developer access to the /dev/* path while restricting the /prod/* path.
• Passthrough Reference: Accessing a Secrets Manager secret via the SSM Parameter Store API.
  • Example: An application coded to only use ssm:GetParameter can retrieve a secret from Secrets Manager by using the path /aws/reference/secretsmanager/secret_name_here.

Worked Examples

Scenario: Updating a Database Password with Zero Downtime

1. Requirement: Rotate an RDS password every 30 days.
2. Implementation:
   • Store the secret in AWS Secrets Manager.
   • Enable Rotation and select the appropriate Lambda template for RDS.
   • The Lambda function:
     • a. Generates a new password.
     • b. Updates the RDS database with the new password.
     • c. Updates the secret value in Secrets Manager.
3. App Retrieval: The application code fetches the secret by name at runtime, ensuring it always gets the AWSCURRENT version without needing a code redeploy.

Checkpoint Questions

1. Which service should you choose if you need to store 10,000 basic configuration strings and cost is the primary concern?
2. How does an application identify which version of a secret to use in Secrets Manager during a rotation cycle?
3. True or False: SSM Parameter Store can natively generate a random password for you upon parameter creation.
4. What is the specific path prefix required to reference a Secrets Manager secret within a Parameter Store API call?

[!NOTE] Answers: 1. SSM Parameter Store (Standard). 2. By using staging labels (defaulting to AWSCURRENT). 3. False (Secrets Manager has this, SSM does not). 4. /aws/reference/secretsmanager/.

Muddy Points & Cross-Refs

• Confusion over Rotation: Remember that while SSM can store values that change, Secrets Manager is the only one with the logic to actively change the password in the target service (like RDS).
• Cross-Account Access: Secrets Manager is much easier for cross-account sharing because it supports Resource-based Policies. Parameter Store requires IAM roles in the source account to be assumed by the destination account.
• Reference: For more on securing the pipeline itself, see Unit 6: Security and Compliance.

Comparison Tables

When to Use Which?