Skip to main content

Handling AWS Cross-Account Secrets In A Scalable Way

By Robert Mutua

AWS Secrets Manager is a service that helps you protect secrets like API keys, database passwords, and other sensitive information. You can rotate, manage, and retrieve secrets with ease.

However, when it comes to cross-account secrets, the process can get a bit more complicated. There are many reasons why you might need to share secrets between AWS accounts. For example, you might have a development account and a production account, and you need to share secret configuration data between them. Or you might have multiple accounts for different parts of your organization, and you need to share secrets between them.

In either case, it's important to handle secrets in a way that is secure and scalable. Here are three ways to do that:

  1. Use AWS KMS to encrypt the secrets and store them in an S3 bucket. Grant access to the S3 bucket from the other account(s) as needed.

  2. Use AWS SSM to encrypt the secrets and store them inParameter Store. Grant access to the Parameter Store from the other account(s) as needed.

  3. Use a tool like Hashicorp Vault to encrypt the secrets and store them externally (outside of AWS). Then, grant access to the Vault from the other account(s) as needed.

Challenges on those solutions

There are a number of challenges that need to be considered when using these solutions:

  • Managing cross-account secrets can be difficult and time-consuming.

  • There is the potential for secrets to be accidentally leaked.

  • There is the risk of human error when managing secrets.

  • Secrets management needs to be scalable in order to support a large number of secrets and a large number of users. - Secrets management must be able to support a variety of secrets, such as API keys, database passwords, and encryption keys.

Conclusion

There are a few different options available to you when it comes to handling secrets in a cross-account AWS environment. Each option has its own benefits and drawbacks, so be sure to consider all of your options carefully before making a decision. Ultimately, the best way to handle secrets in a cross-account AWS environment will depend on your specific needs and preferences.

Read next