Application Secret Management with AWS KMS
summary
Uses AWS KMS with an encryption‑context policy so only an instance with the right IAM roles can decrypt secrets stored in GitHub as ciphertext. Jenkins encrypts plaintext and commits the blob; a briefcase cookbook (Chef) decrypts at boot during deployment. Adds iptables rules to block the EC2 metadata endpoint for non‑whitelisted users so read‑only logins cannot steal temporary credentials. Implemented at CapitalOne to meet segregation‑of‑duties rules, cheap and scalable, and it works in production.
AI-written summary · about
chapters (4)
related talks
20mSecuring workloads using data protection services
29mManaging Secrets in Your Cloud Environment
55mHandling secrets in cloud-based applications
17mPreventing unauth'd credential access on GitHub using AWS services
51mUsing Key Management Service for data protection
31mCloud Hacking Scenarios
28mYour Secrets in Cloud-Based Key Management Services
58mUsing AWS data protection services for innovation and automation