Stephane: Okay, so a quick lecture
on Secrets Manager monitoring
'cause there are two things you need to know.
The first one is that CloudTrail does capture API calls
made to the Secrets Manager API, but also CloudTrail,
and this is very unique, will capture other related events
that might have a security or compliance impact
on your accounts or might help you
troubleshoot operational problems.
And these events are called non-API service events,
and they're specific to Secrets Manager.
And, so, as you can see, CloudTrail will receive
both API calls and non-API events in the CloudTrail.
So what are these non-API service events?
Well, the first one will be a RotationStarted event.
So whenever Rotation starts,
it will be registered in CloudTrail.
RotationSucceeded event, that makes sense.
RotatonFailed event, this is very important.
RotationAbandoned event, this is when there is
a manual change to a target secret
instead of an automated Rotation.
This will also be registered in CloudTrail.
StartSecretVersionDelete events,
CancelSecretVersionDelete events
and EndSecretVersionDelete events.
So, all these things, the idea to have is that whenever
something happens, within the Secret Manager,
it will be recorded in CloudTrail,
and these are very, very important events.
And we can build some, sort of, alerting (indistinct),
so very important one is, for example,
if the Rotation has failed.
So we can combine with CloudWatch Logs and CloudWatch alarms
automations to create, for example,
an alert in case a RotationFailed event happens.
So how do we do this?
Well, CloudTrail stores it's logs in CloudWatch Logs, right,
and on top of CloudWatch Logs we can create a metric filter,
and this metric filter can have us create a metric
to alert for these RotationFailed events,
appearance, for example, and then it will be sent
into a CloudWatch alarm that will send a notification
to SNS whenever we reach that metric threshold.
So this is quite important and quite good to know.
So that's one way of being aware
that there has been an issue,
or something very important happening, with Secrets Manager,
but the other way to do it
is to troubleshoot the Rotation itself.
So let's say that there is a Rotation fail,
so Secrets Manager will store, as we said,
all the API calls and non-API events in CloudTrail.
And Secrets Manager, upon a Rotation of secrets,
is going to try to invoke a Lambda function
that will be performing the Rotation itself.
Now this Lambda function, for example, has a target
to change the password on an Amazon RDS database,
but let's assume that there is an error
and this Rotation did not work.
We don't know why, right.
Well, if you wanted to debug what's happening,
where would we look?
We would look in CloudTrail or in the Lambda function logs,
and, obviously, the better place to look at
is the Lambda function logs because it contains
the actual code execution, and will give you
a proper error message as to what happened
during an execution.
So all these logs, in CloudWatch Logs,
are really, really helpful, and, as an administrator,
this is where you will debug your issues with Rotation,
but to be alerted that the Rotation did fail
we could look at either CloudTrail or also have alerts
on the Lambda function failure rates, okay.
So that's it for Secrets Manager,
troubleshooting and monitoring.
I hope you liked it, and I will see you in the next lecture.