11.3 Secure Credentials & Secrets Management with AWS Secrets Manager & Parameter Store

Secure Credentials & Secrets Management with AWS Secrets Manager & Parameter Store

Data pipelines frequently interact with relational databases (Amazon RDS, Amazon Redshift, PostgreSQL, MySQL), third-party SaaS APIs, and external storage engines. Storing hardcoded database credentials, API keys, or private tokens inside code repositories, Glue scripts, or Airflow DAGs creates severe security vulnerabilities. AWS provides two key management services for securing configurations: AWS Secrets Manager and AWS Systems Manager Parameter Store.

---

Secrets Manager vs Parameter Store: Architectural Comparison

Selecting the right credentials management tool is a core topic on the DEA-C01 exam. The following table contrasts their capabilities:

---

AWS Secrets Manager Deep Dive

Secrets Manager stores secrets as JSON structures containing database usernames, passwords, hostnames, ports, and engine types.

Automated Secret Rotation Mechanics

Secrets Manager coordinates credential rotation; downtime avoidance depends on the rotation strategy and client refresh behavior using an AWS Lambda function executing a four-step staging process:

[ CreateSecret ] --> 1. createSecret (Generates new password -> AWSPENDING)
                          |
                          v
                     2. setSecret (Updates RDS/Redshift user password)
                          |
                          v
                     3. testSecret (Verifies connection using AWSPENDING)
                          |
                          v
                     4. finishSecret (Swaps AWSCURRENT label to new password)

The Staging Label Workflow:

• AWSCURRENT: The active secret version currently used by applications.
• AWSPENDING: The candidate secret version currently being configured and tested against the database.
• AWSPREVIOUS: The prior secret version maintained for rollback or legacy connection cleanup.

During rotation, Secrets Manager updates the target database first using a master credential, verifies connection with AWSPENDING, and then atomically promotes AWSPENDING to AWSCURRENT.

---

Data Pipeline Integration Patterns

1. AWS Glue ETL Jobs Integration

Instead of passing JDBC passwords into Glue job arguments, AWS Glue native connections integrate directly with Secrets Manager:

import boto3
import json

def get_secret(secret_name, region_name="us-east-1"):
    client = boto3.client('secretsmanager', region_name=region_name)
    response = client.get_secret_value(SecretId=secret_name)
    return json.loads(response['SecretString'])

# Retrieve DB credentials securely inside Glue Executor
db_credentials = get_secret("prod/redshift/analytics_user")
db_url = f"jdbc:redshift://{db_credentials['host']}:{db_credentials['port']}/{db_credentials['dbname']}"

2. High-Throughput Lambda Caching (Parameters & Secrets Extension)

If an AWS Lambda function processes millions of Kinesis streaming records and invokes GetSecretValue on every execution, it will incur high API costs and hit Secrets Manager API throttling limits.

Best Practice Solution: Use the AWS Parameters and Secrets Lambda Extension as a Lambda layer. The extension runs a local HTTP cache inside the Lambda execution environment. Lambda code fetches secrets over local HTTP (http://localhost:2773/secretsmanager/get?secretId=...), serving requests directly from local memory cache.

---

AWS Systems Manager Parameter Store Deep Dive

SSM Parameter Store is ideal for centralizing non-sensitive environment variables (e.g., S3 bucket names, database endpoint URLs, max batch sizes) or low-cost secrets using SecureString.

Parameter Types & Encryption

1. String: Plaintext text values (e.g., /config/prod/s3_landing_bucket).
2. StringList: Comma-separated lists (e.g., /config/prod/subnets).
3. SecureString: Encrypted at rest using a customer managed or AWS managed KMS key; callers request decryption with WithDecryption and need kms:Decrypt permission when applicable.

Parameter Policies

Parameter Store supports automated lifecycle management policies:

• Expiration: Automatically deletes parameters after a specified date/time.
• ExpirationNotification: Triggers an EventBridge notification prior to parameter expiration.
• NoChangeNotification: Alerts administrators if a parameter has not been updated for a set number of days.

---

Security & IAM Best Practices for Secrets

1. Restrict Secret Retrieval: Grant secretsmanager:GetSecretValue and ssm:GetParameter strictly to designated execution roles.
2. KMS Key Access: Ensure the principal has kms:Decrypt permissions on the KMS key used to encrypt the secret.
3. Enforce Secret Naming Hierarchy: Use path hierarchies (e.g., /prod/etl/redshift/app_user) to grant scoped access via IAM wildcards (arn:aws:ssm:us-east-1:123456789012:parameter/prod/etl/*).

Summary Checklist for DEA-C01 Exam

• Automatic Rotation: Choose Secrets Manager over Parameter Store when automatic database credential rotation is required.
• Lambda Caching: Use the AWS Parameters and Secrets Lambda Extension to prevent API throttling.
• Parameter Store Cost: Use SSM Standard Parameters for free, lightweight, non-rotating configuration storage.

Rotation-safe consumers

Automatic rotation only helps when clients can adopt the new value. Applications should fetch by secret identifier rather than embedding a version ID, cache for a bounded time, and retry authentication once after refreshing the cache. During rotation, Secrets Manager staging labels identify the current and pending versions. The rotation function creates, applies, tests, and then promotes the pending credential; a failed test must not promote it. Database connection pools need a strategy to retire connections authenticated with the former credential without interrupting in-flight work.

Use resource policies and KMS key policies for cross-account secret access, and restrict both GetSecretValue and decrypt permission. Parameter Store SecureString can protect sensitive configuration, but it does not provide the same managed rotation workflow as Secrets Manager.