CODEWITHSUNDEEP
amazon-web-servicesamazon-ec2aws-code-deploy
rabishah
rabishah

Reputation: 561

How do I handle configuration files containing credentials in AWS?

I've been using AWS Codedeploy using github as the revision source. I have couple of configuration files that contains credentials(e.g. NewRelic and other third party license key) which I do not want to add it to my github repository. But, I need them in the EC2 instances.

What is a standard way of managing these configurations. Or, what tools do you guys use for the same purpose?

Upvotes: 3

Views: 594

Answers (3)

Rodrigo Murillo
Rodrigo Murillo

Reputation: 13648

The previous answers are useful for managing AWS roles/credential specifically. However, your question is more about general non-AWS credentials, and how to manage them securely using AWS.

What works well for us is to secure the credentials in a properties file in a S3 bucket. Using same technique as suggested by tedder42 in A safer way to distribute AWS credentials to EC2, you can upload your credentials in a properties file into a highly secured S3 bucket, only available to your instance, which has been configured with the appropriate IAM role.

Then using CodeDeploy, you can add a BeforeInstall lifecycle hook to download the credential files to a local directory via the AWS CLI. For example:

aws s3 cp s3://credentials-example-com/credentials.properties c:\credentials

Then when the application starts, it can read those credentials from the local file.

Upvotes: 1

Jonathan Turpie
Jonathan Turpie

Reputation: 1363

Launch your EC2 instances with an instance profile and then give the associated role access to all the things your service needs access to. That's what the CodeDeploy agent is using to make calls, but it's really there for any service you are running to use.

http://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_switch-role-ec2_instance-profiles.html

Upvotes: 0

300D7309EF17
300D7309EF17

Reputation: 24643

First, use IAM roles. That removes 90% of your credentials. Once you've done that, you can store (encrypted!) credentials in an S3 bucket and carefully control access. Here's a good primer from AWS: https://blogs.aws.amazon.com/security/post/Tx1XG3FX6VMU6O5/A-safer-way-to-distribute-AWS-credentials-to-EC2

Upvotes: 2

Related Questions