In today’s digital landscape, even a small security lapse can lead to massive financial and reputational damage (just look at the recent incident at M&S). One of the most overlooked risks in cloud-based applications is poor handling of sensitive data (or “secrets”) such as passwords, API keys, and credentials.
Every modern software application requires access to sensitive information, database passwords, cloud service credentials, API keys, and more. Collectively, this data is called “secrets.” If these secrets are mishandled, they can expose an organisation to serious risk. For businesses, securing these secrets is not just a technical issue, it’s a business-critical concern.
What could go wrong?
Poor secrets management can lead to:
Data breaches: Hackers gaining access to sensitive customer or corporate data.
Service outages: Applications failing because a key secret was deleted or expired.
Compliance violations: Failing to meet standards like GDPR.
In 2019, security researchers discovered that thousands of GitHub repositories were publicly exposing AWS credentials. One particularly high-profile case involved an Uber engineer who had accidentally committed AWS keys to a public repo. Attackers used these keys to access sensitive cloud infrastructure, resulting in the exposure of personal information for over 50,000 Uber users.
How do businesses typically handle secrets?
Manual methods
- Secrets stored in local .env files or spreadsheets.
- Secrets sent over email or messaging apps.
These can be easily leaked, hard to track and are difficult to update securely.
Automated but DIY methods
- Use of encrypted files or basic password managers to store secrets.
Better than manual methods, but still hard to scale and audit.
Managed cloud solutions (e.g. AWS Secrets Manager or AWS Parameter Store)
- Secrets stored centrally, encrypted, with fine-grained access control.
- Automatic rotation and integrated auditing.
Strong security, easier compliance, scalable management, and easy integration with our digital products already hosted in AWS.
How AWS Secrets Manager and Parameter Store keep secrets safe
AWS Secrets Manager is a cloud service that securely stores and manages access to secrets. Key features include:
- Encryption: Secrets are encrypted at rest and in transit.
- Access control: Use AWS IAM to define who can access which secrets.
- Automatic rotation: Secrets like database passwords can be changed on a schedule.
- Audit logs: Monitor who accessed what, and when, with AWS CloudTrail.
- Integration: Easily used with AWS services and third-party apps.
AWS Systems Manager Parameter Store is another AWS service used to manage configuration data and secrets. While it doesn’t support automatic rotation, it offers:
- Secure storage for strings, passwords, and configuration parameters.
- Hierarchical organisation for structured access.
- IAM-based access control and encryption with AWS KMS.
Business benefits of secure secrets management
A well-implemented secrets management strategy significantly reduces the risk of security incidents and data breaches by ensuring sensitive information is stored and accessed securely. It also helps organisations more easily align with regulatory requirements, such as GDPR, reducing the risk of non-compliance. Operationally, it allows for faster onboarding and offboarding of team members by centralising secret access and automating permissions. Ultimately, this builds greater trust with customers and stakeholders by demonstrating a strong commitment to data security.
Managing secrets securely is a foundational best practice in modern software application development. As part of the Technical/Product Excellence Group, we are actively reviewing our current handling of secrets across all our digital products to ensure our operations align with industry best practices using tools such as AWS Secrets Manager and Parameter Store.
By Gregg Rogers
Gregg Rogers is Senior Software Engineer at Skewb. To speak with him about this topic in more detail, you can connect with him on LinkedIn.
