Software systems generally need to access shared passwords that can be credentials to access database or tokens to access other web applications.
It's not ideally a best practice to store these credentials within the code itself, as there have been many incidents of code leaks or developers pushing code that contains keys to public repositories, which leads to systems getting compromised.
So, we need a secure way to store credentials in an encrypted form and retrieve it on the go from the servers whenever required.
CredStash is a great tool that makes use of envelope encryption to store the shared secrets in DynamoDB (NoSQL database).
Let's look into how it works. Whenever we want to store a credential (username and password ), credstash will call AWS KMS and generate a new data encryption key.
The data encryption key encrypts the...
