Security and secrets: KMS, Secrets Manager and threat detection

KMS protects keys, not your design

KMS is a key-management service. It does not decide who should read a database password or whether an application should have access to production. IAM policies and KMS key policies decide that.

Most AWS encryption uses envelope encryption. A service generates a data key, encrypts the data with the plaintext data key, then asks KMS to encrypt the data key with a KMS key. The plaintext data key is discarded after use. KMS protects the small key operation; the service protects the data.

AWS-managed keys are created and operated by AWS for a service, such as the key behind SSM SecureString. A customer-managed key gives you more control over policy, rotation, aliases and deletion, but also gives you more responsibility and can add cost. This lesson uses no customer-managed key.

$ aws kms describe-key \
    --key-id alias/aws/ssm \
    --query 'KeyMetadata.{KeyManager:KeyManager,KeyState:KeyState}'

The real practice run returned KeyManager AWS and KeyState Enabled. That confirms the SSM parameter uses an AWS-managed key, not a customer-created key.

Secrets have a lifecycle

Secrets Manager is for credentials and other values that need a secret lifecycle. It stores versions, controls access with IAM, records API use in CloudTrail and can support rotation. The application should retrieve a secret at runtime using its role, not bake the value into an image or repository.

$ aws secretsmanager create-secret \
    --name academy-security-demo \
    --secret-string '{"username":"demo-app","token":"lesson-only"}'
$ aws secretsmanager get-secret-value \
    --secret-id academy-security-demo \
    --query SecretString \
    --output text
$ aws secretsmanager delete-secret \
    --secret-id academy-security-demo \
    --force-delete-without-recovery

Force deletion is appropriate only for disposable practice data. Production deletion normally uses a recovery window so an accidental delete can be reversed. Secret names and values are different: a name can appear in configuration, while the value must stay out of logs and shell history.

Parameters are configuration

SSM Parameter Store is a convenient hierarchy for configuration. String is readable configuration. StringList is a comma-separated list. SecureString encrypts the value and requires permission to decrypt it.

$ aws ssm put-parameter \
    --name /academy/security-demo/app-name \
    --type String \
    --value academy-demo
$ aws ssm put-parameter \
    --name /academy/security-demo/api-token \
    --type SecureString \
    --key-id alias/aws/ssm \
    --value lesson-only-token
$ aws ssm get-parameters \
    --names /academy/security-demo/app-name /academy/security-demo/api-token \
    --with-decryption \
    --query 'Parameters[].{Name:Name,Type:Type,Value:Value}'

Use a path that reflects ownership and environment, then grant access to only that path. SecureString encrypts at rest; it does not make a value safe to print in a CI log. Delete a practice parameter when the exercise ends.

Detection is not prevention

GuardDuty analyses supported AWS account and workload signals for suspicious activity. Security Hub collects security findings and standards in one place. Neither is a replacement for least privilege, patching, backups or an incident response process.

I did not enable GuardDuty or Security Hub in this lesson. Enabling account-wide detection services was outside the approved resource list. In a real account, check the region, delegated administration and cost before enabling them, then route findings to the people who can act.

Edge controls have different jobs

AWS WAF filters HTTP requests at supported application edges. It can match rules for IPs, headers, paths or known attack patterns. AWS Shield helps protect against distributed denial-of-service attacks. WAF is an application-layer filter; Shield is a DDoS protection service. Neither is a secret store or a substitute for secure application code.

Secret storage is a lifecycle, not a string

Secrets Manager is for credentials that need versions, retrieval auditing and optional rotation. Parameter Store is a hierarchical configuration store: use String for ordinary settings and SecureString when the value needs encryption at rest. KMS AWS-managed aliases such as aws/secretsmanager and aws/ssm avoid creating a customer key for a short exercise; customer-managed keys are for ownership and key-policy control that you are prepared to operate.

⤢ View

Rotation is optional per secret: a Lambda function changes the value on a schedule. It's left off for a demo secret.© Screenshot: DevOps Academy

Close

⤢ View

The review step: the AWS-managed key aws/secretsmanager encrypts the secret, so no customer key is needed.© Screenshot: DevOps Academy

Close

$ aws secretsmanager get-secret-value --secret-id "$SECRET" --query SecretString --output text
$ aws ssm get-parameters --names "$PLAIN" "$SECURE" --with-decryption \
    --query 'Parameters[].{Name:Name,Type:Type,Value:Value}' --output table
$ aws kms list-aliases --query 'Aliases[?starts_with(AliasName, `alias/aws/`)].AliasName' --output text

The first command reads one version; the second deliberately uses --with-decryption for the SecureString; the third confirms that the exercise uses AWS-managed aliases. Delete the secret with --force-delete-without-recovery, delete both parameters, and verify each identifier is gone.

$ REGION=ap-south-1
$ PROFILE=anythinkx
$ SECRET=academy-security-demo
$ PLAIN=/academy/security-demo/app-name
$ SECURE=/academy/security-demo/api-token
$ aws secretsmanager create-secret --profile $PROFILE --region $REGION --name $SECRET --secret-string '{"username":"demo-app","token":"lesson-only"}'
$ aws ssm put-parameter --profile $PROFILE --region $REGION --name $PLAIN --type String --value academy-demo
$ aws ssm put-parameter --profile $PROFILE --region $REGION --name $SECURE --type SecureString --key-id alias/aws/ssm --value lesson-only-token
$ aws secretsmanager get-secret-value --profile $PROFILE --region $REGION --secret-id $SECRET --query SecretString --output text
$ aws ssm get-parameters --profile $PROFILE --region $REGION --names $PLAIN $SECURE --with-decryption --query 'Parameters[].{Name:Name,Type:Type,Value:Value}'
$ aws kms describe-key --profile $PROFILE --region $REGION --key-id alias/aws/ssm --query 'KeyMetadata.{KeyManager:KeyManager,KeyState:KeyState}'
$ aws secretsmanager delete-secret --profile $PROFILE --region $REGION --secret-id $SECRET --force-delete-without-recovery
$ aws ssm delete-parameters --profile $PROFILE --region $REGION --names $PLAIN $SECURE
$ aws secretsmanager get-secret-value --profile $PROFILE --region $REGION --secret-id $SECRET --query SecretString --output text
$ aws ssm get-parameter --profile $PROFILE --region $REGION --name $SECURE --with-decryption --query Parameter.Value --output text