Hi, everyone, and welcome back.
Now, in today's video, we are going to discuss about eight secrets manager.
Now, before we understand about this service in great detail, it is important that we take up the
basics about the challenges that the organization faces and the basics of secrets management.
Now, one of the common issues related to security that you will see in many of the organizations is
that the secrets are hardcoded directly as part of the application or directly as part of the server.
For example, you have an easy to instance that wants to communicate to the database, and there is
some kind of application that is running on the AC two now for this EC two to be able to connect to
the database, the credentials will be needed, the database username, database password and so on.
All of these credentials you will generally see that they are hardcoded as part of the application or
are configured as part of the EC2 instance.
So in this case, if the server is compromised, then these credentials are also leaked and in case
if these credentials are hardcoded as part of the application, anyone that has access to the central
repository where the application code is stored, they will be able to also access these credentials.
One more challenge that you will see in line with this is that if you want to rotate the secret credentials,
then all of the servers where the application is installed also needs to be updated with the latest
set of credentials.
If you miss one of the servers, then the production can go down.
For example, let's say that you have certain credentials that are added as part of your application
code in easy to instance, and some of the members of the application team are now leaving the organization.
So what you want?
Ideally, you want to rotate all of the credentials so that after the team member leaves the organization,
they will not be able to use or share these credentials here.
So in such cases you will have to update the application and deploy the newer application code or change
the credentials file that is stored as part of the server.
So in order to overcome these set of challenges as well as many others, you have an area of secrets
management that is introduced.
So at a high level overview, secret management is a practice that allows the developers to securely
store sensitive data such as password keys and tokens in a secure environment with strict access control.
So in this type of architecture, if you'll see instead of hard coding the credentials as part of the
application or easy to the credentials are stored in a dedicated tool.
In this case it is Hashicorp vault, and whenever application wants to connect to the database, then
the application can connect to the secrets management tool, fetch the latest credentials, and through
these credentials they can connect to the database.
Now, in the area of secrets management, there are various popular tools that are available in the
industry.
One of the very popular ones that you will see in organizations is Hashicorp Vault.
Along with that, a Secrets manager is also one of the tools that you can use as part of the secrets
management.
So similar to the earlier architecture at a high level overview inside of the Hashicorp vault that we
saw in the earlier slide, you have the secret manager here and the easy to instance can fetch the credentials
from secrets manager and then use those credentials to connect to the appropriate endpoint.
One of the great things about Secrets Manager is that it supports various things, including storage
of credentials, rotating of credentials and other lifecycle events.
So this is the basic With this, let's go ahead and understand things in more detail.
Now.
First, as we're discussing, there are various popular tools related to secrets management that are
available in the industry.
One of the very popular ones that you will see in enterprises and large scale organization is Hashicorp
Vault.
So Hashicorp vault, again, it's quite loaded with a lot of features and it allows the basics of secret
storage and management.
Now, in fact, let me also quickly show you this.
So this is the Hashicorp Vault console, and within you will be able to create secret so you can add
a key as well as the appropriate value.
So if I say test and test and part of secret, I'll just say it is I'll click on Save and this is the
secret that is created.
Apart from that, you can also create multiple versions of secrets.
You can rotate the secrets and so on.
So the idea is that all of the secrets are stored in a central location, in this case, Hashicorp Vault,
and any application or any developer, when they need credentials, they can fetch it from the Hashicorp
vault.
Now, one of the great things about the Hashicorp Vault solution is that it supports a wide variety
of engines.
So your Active Directory is Azure GCP, You have SSH over here, you have databases and various others
now similar to the Hashicorp Vault also has a secret manager.
Again, it is not as feature rich as vault, but it does the basic aspects of secrets management.
Now, currently I am in the.
It's manager console.
And here you see that there are two secrets that are created.
One is called Explode App and second one is related to database.
So if you'll open up the prod app over here, these are the secret configurations here and you have
a secret value.
So if you want to retrieve the secret value, you can do it from the UI.
So you see you have a secret user and secret password or from the application.
Also you will be able to retrieve the secret values and secret password, considering that the application
has the appropriate access or this specific secret.
Now, at an overview, this is very similar to what you'll also see in the vault where you have a specific
secret, and if you want to fetch the value, you can easily do that.
You have test and test considering that you have the appropriate permission.
All right.
So you will see quite good amount of similarity here.
Apart from that, one of the good things about Secrets manager is its integration with various services,
including ideas.
For example, this specific secret that you see is associated with the RDX instance.
So if I quickly open this up, you can see that there is a node which states this secret was created
by Amazon ads.
Now what does this secret contain?
It contains the username and password to connect to the database.
Now let's also quickly look into it.
So if I quickly open up the IDS console.
You will see that I have one database instance.
The name is Test hyphen database.
So in order to connect to this database, we need credentials.
And these credentials are stored as part of the secret manager Secret.
So in this specific secret, you have a secret value.
If you look into this specific value, you have a username of admin and you have this specific password.
Now, apart from that, one more thing I wanted to show you as we're discussing Secret manager, the
advantages is this integration.
Now if you generally create a database, again, this is just for a demo.
For a better understanding, let's select my SQL engine.
Now, generally when you create a database, you have to define the username and password.
So in here you can define the username admin and you can supply your own password.
However, in case if you do not want to do that because in order to supply username and password, the
administrator has to also write it somewhere for ease of use.
So instead of going through that route, what you can do either you use the auto generated password
again, you'll have to store the auto generated password somewhere.
Most of the times you will see that the users are storing the auto generated password or even the custom
generated password in notepad.
This is something that you do not really want.
So instead of that you can select manage the master credentials in Secrets Manager.
So in such cases you do not really need to worry about the password.
Let the password be stored at a secret manager level.
In fact, RDR will take care of the specific secret and also the password will be encrypted and only
the appropriate users and servers will have the permission to this specific secrets.
Great.
So I hope with this you understood in a better terms related to the overall secrets management and the
Secret Manager Service.
Now, one of the question that generally comes is in which scenario will you use world or in which scenario
you would use Secrets Manager Now, in such cases, if you want to keep things simple, because if you
are choosing Hashicorp vault again, Hashicorp vault is not a small tool.
There are a lot of features and in fact we have a dedicated course based on Hashicorp vault, so it
is quite detailed.
Now if your organization has a very small team and you do not really want to give a lot of time into
the secret management tool and configuring it for high availability, etc. straight away, you can use
Secret manager.
However, in larger organizations where there are a lot of compliances, you have good amount of resources
to implement the overall best practices as part of secrets management.
Then, in such cases, Hashicorp Vault is one of the recommended tools that you can use.
Now, before we conclude, I have also attached a diagram from the docs so that when you are revising
through PPD, it becomes easier to understand.
Now if you'll see you have a secrets manager.
Now, all of the secrets that are part of secrets manager are encrypted.
You can make use of the CMS for the overall encryption and we have seen on how it integrates with various
services like RDA.
You can also integrate it with your application and so on.
Apart from that, you will be able to perform the overall audit related to the secret manager who is
accessing etc. through various services like cloud, rail and Cloud watch as well.
So that's a very high level overview about Secrets management and Secrets Manager.
And with this will conclude today's video.