At their San Francisco Summit today, Amazon released AWS Secrets Manager. It’s a native AWS service that simplifies the vaulting of application secrets in their cloud.
It was great to hear the clapping when AWS’ CTO talked during the keynote about the importance of taking secrets out of code. One thing that struck me and others in the Conjur engineering team: Amazon stated that the service would mean that developers would no longer have to touch application secrets. However, only moments later, we heard that the service relies on developers changing their application code to call an API to retrieve secrets at runtime.
We believe strongly that security should be the responsibility of security practitioners and developers should focus on application features. That’s why we quickly ran to our keyboards and made AWS Secrets Manager even more favorable to developers by integrating it with Summon.
Summon is an open source tool that we developed to save developers from having to call backend vault APIs of any kind. It retrieves secrets on their behalf and then conveniently injects them into the application’s environment, following the 12 Factor App best practices and allowing the developer to just focus on building features.
Summon also isolates application code from the choice of vaulting solution you’re using, so if you ever plan to migrate to a different vault backend in the future (such as Conjur) then using Summon can make that transition a zero impact event for your application code. Summon already has providers for many other secret storage systems and vaults, and adding other providers is a simple task.
Our engineers weren’t expecting today to be a FedEx day, but the 90 minutes it took the team to take the new AWS service, learn it, integrate it into Summon, and release it seemed more than worthwhile. We hope you enjoy using it as much as we enjoyed bringing it to life. The code is now available on GitHub. Come talk to us on the CyberArk Commons about it. We’re excited that AWS is emphasizing the importance of security, and secrets management is just one aspect of a healthy approach to privilege.
Brian Kelly is Head of Conjur Engineering at CyberArk, where he focuses on creating products that add much-needed security and access management to the landscape of DevOps tools and cloud systems. Brian is passionate about building teams, cybersecurity, and DevOps. Find him on Twitter at @brikelly.