approach for secure and resilient applications
summary
Capital One manages thousands of AWS accounts and millions of secrets and builds a centralized lifecycle system: a gatekeeper API in a control account that uses AWS Secrets Manager, Lambda, Route 53, Auto Scaling and DynamoDB for metadata, with cross‑Region replication and active‑active multi‑Region failover. Rotation runs via Lambda either centrally or locally (for external targets), resource policies and attribute‑based controls deny human IAM roles and limit blast radius, and the solution meets availability, rotation and auditability goals in production.
AI-written summary · about
chapters (6)
- 0:00Introduction and agenda
- 2:58Capital One context
- 10:46Centralized management
- 19:36Security control models
- 34:48Secret rotation strategies
- 44:59Resiliency and conclusion
related talks
31mAutomating the Management of the Operational Health of Cloud Accounts at Scale
55mBalance least privilege & agile development
53mAchieving End-to-end Security on AWS
29mManaging Secrets in Your Cloud Environment
27mIntroduction to AWS Security
44mAchieve your identity, security, and compliance goals on
58mUsing AWS data protection services for innovation and automation
45mSecurity Lessons Learned Moving a Bank 100% in the Cloud