Handling secrets in cloud-based applications
summary
Demo deploys a .NET app to Elastic Beanstalk, lists S3 buckets and EC2 instances, and replaces local credential profiles with IAM roles with trust relationships so hosts receive time‑limited credentials automatically. Shows use of AWS CLI and PowerShell, Azure DevOps tasks to fetch or create secrets at build time, and a runtime pattern using Parameter Store vs Secrets Manager plus a secrets manager caching library to avoid constant API calls. Notes that secrets rotation, KMS encryption, and scoped IAM policies are applied and that a masking bug in logs was observed.
AI-written summary · about
chapters (17)
- 0:00Intro
- 0:24This session
- 2:32Some existing solutions (and solutions ) • Hard-coding in the app code or configuration files
- 5:16Defining "application credentials"
- 7:36Handling credentials in deployed applications
- 8:53AWS Identity and Access Management
- 9:27IAM Roles
- 10:38Permissions and Policies
- 11:26Putting it together Local env
- 24:10AWS Systems Manager Parameter Store
- 26:17@AWS Secrets Manager
- 27:15Comparing Parameter Store and Secrets Manager
- 27:48But...they're also integrated
- 35:07Build-time secrets
- 44:26Runtime secrets
- 44:45NuGet packages for Parameter Store & Secrets Mar
- 52:57Session recap
related talks
44mSecrets at Scale: Managing Cloud Credentials with PowerShell Automation
29mManaging Secrets in Your Cloud Environment
47mManaging your Secrets in a Cloud Environment
30mSimplifying Secrets Management in the Public Cloud
38mAdventures in Cloud Security: What DevOps Can Learn from a Security Engineer
10mCan you keep it a secret?
01h 03mContinuous Security in the Cloud
55mConfiguration management and service discovery in a serverless world. DevOps Fest'19