Evaluating a Strategy for the Secure Management of Secrets and Credentials

Another essential element to consider when improving your security posture is protecting the access credentials, sometimes also called secrets, that your workload needs to access external services such as databases or third-party APIs. AWS provides several options to provide, protect, and store (when needed) these access credentials. However, as you might have already concluded, the most secure credential is the one you don’t have to store. It sounds obvious but it is a key principle, as we are always unfortunately reminded by access credential leakage incidents. As already stressed in Chapter 5, Determining Security Requirements and Controls, it is a recommended best practice to use temporary credentials, whenever possible, when authenticating with external services. The benefit of temporary credentials is that they only live for a limited period of time, that is, they stop working eventually, thus reducing...