The Secret Life of AWS: The Vault (AWS Secrets Manager)

#aws#security#devops#cloud

Stop hiding keys under the doormat. How to manage passwords with AWS Secrets Manager.

Part 25 of The Secret Life of AWS

Timothy was finishing up his security review from Episode 24. He turned to Margaret with a look of accomplishment.

"I have secured the perimeter with WAF," he said. "And I also cleaned up my code. Look."

He pointed to his Python script.

# Before
# db_password = "SuperSecretPassword123!"

# After
db_password = os.environ['DB_PASSWORD']

"I removed the hardcoded database password," Timothy explained proudly. "Now it is stored as an Environment Variable in the Lambda configuration. It’s much safer."

Margaret smiled gently. "That is a great first step, Timothy. Hardcoding secrets is like leaving your house key right in the door lock."

"But," she paused, leaning in closer to the screen. "Using an Environment Variable is like hiding the key under the doormat."

Timothy blinked. "Under the doormat?"

"It is better than the lock," Margaret admitted. "But anyone who has access to your AWS Console can see that variable in plain text. And worse... what happens if we need to change the password?"

"I would have to update the variable and redeploy the function," Timothy said.

"Exactly," Margaret nodded. "And in that few minutes between the database change and your redeploy, your application is broken."

"We need a place to store the key where no human can see it," she said. "And we need a system that can change the lock automatically."

"We need The Vault."

The Vault (AWS Secrets Manager)

Margaret navigated to AWS Secrets Manager.

"Think of this as a digital safe," she explained. "We put the password inside, and we lock the door. Your Lambda function doesn't need to know the password anymore. It just needs the IAM permission to open the safe."

She created a new secret named ProductionDB and stored the credentials inside.

The Retrieval

"Now, we change your code," Margaret said. "Instead of reading a static variable, your code will ask the Vault for the key."

She helped Timothy update the Python script.

import boto3

def get_db_password():
    client = boto3.client('secretsmanager')
    response = client.get_secret_value(SecretId='ProductionDB')
    return response['SecretString']

"See?" Margaret pointed. "Your code never holds the password. It retrieves it at runtime, uses it, and forgets it."

"That is cleaner," Timothy agreed. "But what about changing the password? That was my biggest worry."

The Rotation

Margaret pointed to a tab in the console labeled Rotation configuration.

"This is the magic part," she smiled.

"In the old days, changing a database password was a nightmare. You had to coordinate with the DBA, update the app, and pray you didn't break anything."

"With Secrets Manager," she continued, "The Vault talks directly to the Database."

"We can set it to rotate every 30 days," she explained. "When the time comes, Secrets Manager will:

1. Generate a new password.
2. Log into the Database and change the user's password.
3. Update the secret inside the Vault."

"And my Lambda function?" Timothy asked.

"It never knows the difference," Margaret said. "The next time it asks for the secret, it just gets the new one. No downtime. No redeploys. No humans involved."

Timothy sat back, amazed. "So the system basically changes its own locks?"

"Precisely," Margaret said.

The Standard

Timothy deleted the Environment Variable from his Lambda configuration. The risk was gone.

"I thought I was secure before," Timothy admitted. "But I was just hiding the secret in a different place."

"Security is a journey, not a destination," Margaret assured him. "Environment variables are fine for configuration settings—like 'Debug Mode' or 'Retry Count'. But for secrets? Always use the Vault."

Timothy looked at his application. It was guarded by a Bodyguard (WAF) and now, its most valuable keys were locked in a self-rotating Vault.

"It feels... professional," Timothy said.

"It is," Margaret smiled. "You are building like an Architect now."

---

Key Concepts

• AWS Secrets Manager: A service to securely encrypt, store, and retrieve credentials (database passwords, API keys).
• Hardcoding vs. Env Vars vs. Secrets: The evolution of secret management maturity.
• Runtime Retrieval: Fetching secrets securely via API at execution time, eliminating the risk of exposure in code or configuration.
• Automatic Rotation: The ability of Secrets Manager to automatically change credentials on a schedule without application downtime or human intervention.

---

Aaron Rose is a software engineer and technology writer at tech-reader.blog and the author of Think Like a Genius.