#awssecretsmanager

How to use AWS Secrets Manager's new Cost Allocation Tags feature

Discover how to use Secrets Manager Costs Allocation Tags, a new tool, to better understand your spending.

AWS Secrets Manager manages, retrieves, and rotates database credentials, application credentials, API keys, and other secrets. Replacement of hard-coded credentials in application source code with runtime calls to retrieve credentials dynamically helps prevent unauthorised access to secrets from source code, configuration, or components. Payer accounts control cost allocation tags.

Before this capability, your AWS bill would only show the total cost of Secrets Manager for a given account; fees per secret could not be separated by cost centre or organisation.

AWS Secrets Manager tags cost allocation

New feature: AWS Secrets Manager Cost Allocation Tags. Cost Allocation Tags, a basic AWS feature, can assign a key-value pair to a resource. AWS Cost Explorer supports these cost allocation tags. Once activated, these tags let you classify and track spending. Make a tag group with the value Engineering to identify engineering team resources. Once you activate this cost allocation tag, you can track charges, filter or group by tags in Cost Explorer and add tags to reports for analysis and visualisation, such as cost and use reports.

AWS Secrets Manager now supports cost allocation tags for better expenditure control and visibility. This lets you better classify and track Secrets Manager usage expenses. AWS costs can be better managed by assigning secret charges to cost centres or organisations.

The purpose of cost allocation tags

Tags are labels you or AWS assign to AWS resources. Each tag has a key and value. Every resource must have a unique tag key with one value. Cost allocation tags help you track AWS charges and organise resources.

This new skill lets you:

Dissect Secrets Manager expenditures by company-relevant factors like environment, project, or department.

Check Cost Explorer's itemised Secrets Manager usage and cost and use data.

Improve chargeback and cost allocation across your firms and divisions.

Creating AWS cost allocation tags

The AWS Secrets Manager tag cost allocation process has four steps:

Cost allocation labels are needed.

Tag resources (secrets manager secrets) with cost allocation.

At the AWS Billing console, enable your Cost Allocation Tags.

Tag-filter and group Cost Explorer to create cost categories.

After creating and attaching user-defined tags to resources, the Cost Allocation Tags page in the AWS Billing dashboard may not reveal tag keys for activation for 24 hours. Once tags appear, you must activate them for AWS to track expenses and display them in Cost Explorer. Tag key activation may take further 24 hours.

Create and add user-defined tags for Secrets Manager secret cost allocation using the AWS CLI or Management Console. The tag key CostCenter is used to monitor costs by cost centre.

Select an existing or new secret in the Secrets Manager console and click Tags to edit tags. A key-value pair, like CostCenter, and a cost centre code, such 7263 for engineering or 1121 for finance, would be assigned.

AWS CLI users can use aws secretsmanager tag-resource. The –secret-id and –tags must be key-value pairs (Key=CostCenter,Value=7263). When this command works, no output is usually provided.

Use the AWS CLI or Billing and Cost Management console to enable user-defined cost allocation tags.

Select user-defined cost allocation tags, choose tag keys, then click Activate in the Console to activate cost allocation tags. This opens the AWS Cost Management and Billing window.

The aws ce update-cost-allocation-tags-status command sets the Status to Active and provides the TagKey (e.g., TagKey=CostCenter,Status=Active).

Cost Explorer results are the final phase. After Cost Explorer displays the activated tag (such as CostCenter) under Tags in the Filter or Group By fields, you can filter or group by use and charges.

Cost Explorer lets you set report parameters to see results. After selecting a Date Range, select Dimension as Tag under Group by and choose your tag (e.g., Cost Centre). Filters let you select The Secrets Manager Service.

AWS Key Management Service

Create and manage cryptographic keys to safeguard your data with AWS KMS. Most AWS data-encrypting services are connected with AWS Key Management Service. To record the usage of your KMS keys for auditing, regulatory, and compliance purposes, AWS KMS also connects with AWS CloudTrail.

AWS KMS keys, which are logical representations of cryptographic keys, are the main resource in AWS Key Management Service. KMS keys come in three main varieties:

KMS keys that you create are known as customer managed keys.

KMS keys created in your account by AWS services on your behalf are known as AWS managed keys.

KMS keys that are owned and managed by an AWS service and can be used across several AWS accounts are known as AWS owned keys.

Policies are used in the AWS Cloud to manage who has access to resources and services. For instance, resource-based policies link to a resource, like an S3 bucket, and specify which principals are permitted access, supported actions, and any other requirements that must be fulfilled. In AWS Identity and Access Management, identity-based policies determine user, group, and role permissions. Like IAM policies, AWS Key Management Service policies restrict key access. There must be a key policy for every KMS key, and each key may only have one key policy. When creating policies that grant or prohibit access to KMS keys, keep the following in mind:

For customer-controlled keys, you have direct control over the key policy; however, this is not the case for AWS-owned or managed keys.

Within an AWS account, key policies enable granular access to AWS Key Management Service API calls. You cannot use IAM policies to grant access to a KMS key unless specifically permitted by the key policy. IAM policies that provide permissions are ineffective without the main policy’s consent.

Without the key policy’s matching consent, you can use an IAM policy to prevent access to a customer-managed key.

Take into account the following while creating key policies and IAM policies for multi-region keys:

Key policies are neither duplicated or synced among related multi-Region keys, nor are they shared attributes of multi-Region keys.

Unless a key policy is given in the request, the default key policy is used when a multi-Region key is produced using the CreateKey and ReplicateKey actions.

To restrict permissions to a specific AWS Region, you can use condition keys like aws: RequestedRegion.

Permissions to a multi-Region main key or replica key can be granted via grants. Even though they are related multi-Region keys, a single grant cannot be utilized to provide permissions to more than one KMS key.

The following encryption best practices and other security best practices should be taken into account while utilizing AWS Key Management Service and developing key policies:

Follow the advice in the AWS Key Management Service best practices materials listed below:

AWS Key Management Service grant best practices (AWS KMS documentation)

IAM policy best practices (AWS KMS docs)

Keep the identities of individuals who administer keys and those who use them distinct in compliance with the best practice for separation of duties:

The key shouldn’t be usable by administrator roles that create and remove keys.

Some services might just need to encrypt data; they shouldn’t be allowed to use the key to decode it.

The least privilege principle should always be applied to important policy. Because it grants the principal authority to administer and use the key, kms: should not be used for actions in IAM or key policies.

Use the kms: ViaService condition key in the key policy to restrict the use of customer-managed keys to particular AWS services.

Customer managed keys are recommended if you have a choice between key types since they offer the most detailed control choices, such as the following:

Overseeing access control and authentication

Keys that enable and disable

Changing the AWS KMS keys

Keys for tagging

Making aliases

Getting rid of AWS KMS keys

Unauthorized principals must be specifically excluded from AWS Key Management Service administrative and modification permissions, and no unauthorized principal should have AWS KMS modification permissions listed in an allow statement.

Use the iam-customer-policy-blocked-kms-actions and iam-inline-policy-blocked-kms-actions rules in AWS Config to identify instances of unlawful use of KMS keys. Principals are unable to use the AWS Key Management Service decryption actions on any resource as a result.

To stop unauthorized users or roles from deleting KMS keys directly through a command or the terminal, implement service control policies (SCPs) in AWS Organizations.

Record calls to the AWS Key Management Service API in a CloudTrail log. This logs the pertinent event properties, including the requests made, the originating IP address making the request, and the requester.

Sensitive information shouldn’t be included if encryption is being used. Anyone with access to the S3 bucket holding the data can examine the plaintext JSON files that CloudTrail uses to store the encryption context.

When keeping an eye on how customer managed keys are being used, set up events to alert you when certain actions like creating a key, updating customer managed key policies, or importing key material are noticed. Automated responses, like an AWS Lambda function that disables the key or carries out any other incident response activities specified by your business policy, are also advised.

For certain situations, such compliance, disaster recovery, or backups, multi-region keys are advised. Compared to single-region keys, multi-region keys have substantially different security characteristics. When approving the creation, administration, and use of multi-Region keys, the following guidelines should be followed:

Principals should only be permitted to duplicate a multi-region key into AWS regions that need it.

Permit multi-region keys only for jobs that require them and only for principals who need them.

Manage the secrets lifecycle centrally using AWS Secrets Manager.

What is AWS Secrets Manager?

OAuth tokens, API keys, database credentials, application credentials, and other secrets may all be managed, retrieved, and rotated with the aid of AWS Secrets Manager. Many AWS services store and use secrets using Secrets Manager.

Secrets Manager improves your security posture by removing the requirement for hard-coded credentials in application source code. If you save your credentials in Secrets Manager, anyone who can look at your program or its components could potentially compromise it. A runtime call to the Secrets Manager service lets you dynamically retrieve credentials when needed, replacing hard-coded credentials.

Secrets Manager allows you to create an automatic secret rotation schedule. This greatly lowers the chance of compromise by allowing you to swap out long-term secrets for short-term ones. Rotating credentials no longer necessitates upgrading your apps and sending modifications to application clients because the credentials are no longer kept with the application.

Advantages

Centrally audit and securely encrypt secrets.

Control who has access to secrets.

Rotate secrets on their own.

To help with catastrophe recovery plans, replicate secrets.

Use cases

Keep secrets safe

Manage and keep credentials, API keys, and other secrets in one place.

Use fine-grained policies to control access

To control who may access your secrets, use AWS Identity and Access Management (IAM) permissions policies.

Rotate secrets automatically

Without redeploying or interfering with running applications, rotate secrets on demand or according to a schedule.

Audit and track the use of secrets

Connect secrets to AWS’s notification, logging, and monitoring services.

Features of AWS Secrets Manager

Safekeeping of secrets

Using encryption keys that you hold and keep in AWS Key Management Service (AWS KMS), AWS Secrets Manager encrypts secrets while they are at rest.

Secrets Manager decrypts the secret when you retrieve it and sends it safely over TLS to your local environment.

Using resource-based and fine-grained IAM policies, Secrets Manager connects with AWS Identity and Access Management (IAM) to manage access to the secret.

Rotating secrets automatically without interfering with applications

Using the Secrets Manager console, AWS SDK, or AWS CLI, you may use AWS Secrets Manager to rotate secrets on a schedule or as needed.

Rotating credentials for databases housed on Amazon RDS and Amazon DocumentDB as well as clusters hosted on Amazon Redshift are natively supported by Secrets Manager.

By altering sample Lambda functions, you can expand Secrets Manager to rotate secrets used with other AWS or 3P services.

Secrets are automatically replicated to several AWS regions

To satisfy your specific disaster recovery and cross-regional redundancy needs, you can use AWS Secrets Manager to automatically replicate your secrets to many AWS Regions. There is no need to maintain a complicated solution for this capability; simply specify which AWS regions a secret needs to be replicated to, and Secrets Manager will safely generate regional read replicas. You can trust Secrets Manager to maintain the replicas in sync with the primary secret while granting your multi-Region apps access to replicated secrets in the necessary Regions.

Secret retrieval via programming

When developing your applications, keep hidden security in mind.

Code samples for calling Secrets Manager APIs from popular programming languages are provided by Secrets Manager. Two categories of APIs are available for retrieving secrets:

By name or ARN, retrieve a single secret.

Provide a list of names or ARNs, or filter criteria like tags, to retrieve a collection of secrets.

Set up Amazon Virtual Private Cloud (VPC) endpoints so that communications between Secrets Manager and your VPC remain inside the AWS network.

Additionally, Secrets Manager client-side caching libraries can be used to decrease latency and increase availability while retrieving secrets.

Audit and track the use of secrets

By integrating with AWS logging, monitoring, and notification services, AWS Secrets Manager lets you audit and keep an eye on secrets. For instance, you can inspect AWS CloudTrail logs to audit when a secret is produced or rotated once AWS CloudTrail has been enabled for an AWS Region. Likewise, you can set up Amazon CloudWatch Events to get push alerts when Secrets Manager rotates your secrets, or you can set up Amazon CloudWatch to get email notifications using Amazon Simple Notification Service when secrets aren’t utilized for a while.

Compliance

AWS Secrets Manager can be used to satisfy compliance standards.

Use AWS Config Rules to guarantee your secrets meet enterprise security and compliance standards.

The Department of Defense Cloud Computing Security Requirements Guide (DoD CC SRG IL2, IL4, and IL5), FedRAMP, HIPAA, ISO/IEC 27001, ISO/IEC 27017, ISO/IEC 27018, ISO 9001, and the Payment Card Industry Data Security Standard

Integration of Secrets Manager

Secrets Manager integrates with AWS services to safely handle your login credentials. You can safely swap login credentials with different AWS services thanks to these integrations. Either customer-managed or AWS-managed KMS keys are used to encrypt the credentials kept in Secrets Manager. To maintain a high level of security, Secrets Manager rotates secrets on a regular basis. You will be able to supply an AWS service with the ARN of a secret rather than a plain text credential once your secrets are stored with Secrets Manager.