The Secret Life of AWS: The Keys to the Kingdom

#aws#secretsmanager#iam#kms

Why you never hardcode passwords, and how to implement Least Privilege

Part 14 of The Secret Life of AWS

Timothy was beaming. He spun his monitor around to show Margaret.

"It is perfect," he said. "The runbooks are written, the alarms are set, and the code is clean. I am ready to deploy to production."

Margaret leaned in, adjusting her glasses. She scanned the code. Her finger stopped on Line 12.

const API_KEY = "sk_live_8392_secret_key_dont_share";

She looked up, her expression grave. "Timothy. Did you commit this file to the repository?"

"Yes," Timothy said. "But it is a private repository. No one can see it but us."

Margaret sighed. "Code leaks, Timothy. Laptops get stolen. Contractors get access. If this key escapes, an attacker can drain our bank account in seconds."

"Today," she said, "we discuss Security."

AWS Secrets Manager (No Hardcoded Secrets)

Margaret walked to the chalkboard. She wrote: Rule #1: Credentials never live in code.

"So where do I put them?" Timothy asked.

"You put them in AWS Secrets Manager," she said. "This is a dedicated service for storing sensitive data."

"How does it work?"

"You upload the API Key to Secrets Manager via the console," she explained. "Then, you delete it from your code."

"But how does my code get the key?"

"At runtime," Margaret said. "When your Lambda function wakes up, it makes an API call to Secrets Manager. It asks for the secret value. Secrets Manager checks the permissions, logs the request, and returns the key securely in memory."

"And the best part?" she added. "Secrets Manager can Rotate the key. It can automatically update the password every 30 days. Even if a hacker steals an old key, it will be useless by the time they try to use it."

IAM & Least Privilege (Scope Down)

Margaret turned back to Timothy's screen. She opened the permissions file (IAM Policy) for his Lambda function.

Action: "s3:*", Resource: "*"

"Timothy," she said closely. "Why does your function need access to every S3 bucket in the account?"

"I... I just wanted to avoid a 'Permission Denied' error," Timothy admitted. "It was easier to give it Administrator Access."

Margaret erased the board. She wrote: Rule #2: Least Privilege.

"Right now, your function has Admin Access," she said. "It can read reports, but it can also delete the entire database, wipe the backups, and shut down the network."

"But I trust my code," Timothy argued.

"It is not about trust," Margaret corrected. "It is about Blast Radius. If a hacker finds a vulnerability in your function, they inherit those Admin permissions. They own the entire cloud."

She crossed out the line and wrote:
Action: "s3:GetObject", Resource: "arn:aws:s3:::reports-bucket/2024/*"

"We scope it down. Now, the function can only read the reports bucket—and specifically, only files from 2024. If it is compromised, the hacker is trapped in that one tiny folder. They cannot touch the rest of the infrastructure."

KMS (Encryption at Rest)

"One last thing," Margaret said. "The Database."

"It is behind a firewall," Timothy argued. "It is safe."

"Firewalls stop network traffic," Margaret said. "They do not stop someone from stealing the physical hard drive from the data center. Or a rogue employee from reading the raw files."

She wrote KMS (Key Management Service) on the board.

"We need Encryption at Rest."

"When you enable KMS," she explained, "AWS encrypts your data before writing it to the disk. Your customer's credit card number 4111-2222 is stored as unreadable ciphertext like X7k#9@vL."

"So even if someone physically steals the disk, they cannot read it?"

"Exactly," Margaret said. "This means even AWS engineers with physical access to the drives cannot read your customers' data. Without the encryption key—which is managed by KMS hardware and never leaves the module—the data is just noise."

The Lesson

Timothy looked at his code. He deleted Line 12. He tightened the IAM permissions. He enabled Encryption on the database.

"It feels... annoying," Timothy admitted. "The code has to ask permission for everything. It is slower to write."

"Security is always a trade-off with Convenience," Margaret agreed.

She tapped the screen where the API Key used to be.

"But convenience is cheap. Trust is expensive. And once you lose trust, Timothy, you cannot buy it back."

---

Aaron Rose is a software engineer and technology writer at tech-reader.blog and the author of Think Like a Genius.