Secrets manager in use remediation

Using Console

To remediate the “Secrets Manager Should Be In Use” misconfiguration in AWS using the AWS console, follow these steps:

Log in to the AWS Management Console.
Navigate to the AWS Secrets Manager service.
Click on the “Create secret” button.
Select the type of secret you want to create (such as “Other type of secrets”).
Enter the details for the secret, such as the secret name and the secret value.
Click on the “Next” button.
Configure the rotation settings for the secret, if applicable.
Click on the “Next” button.
Review the details of the secret.
Click on the “Store” button to create the secret.

Once you have created the secret in AWS Secrets Manager, you can use it in your applications and services to securely store and retrieve sensitive information. Make sure to update your applications and services to use the new secret, and delete any other instances of the sensitive information that may have been stored elsewhere.

Using CLI

To remediate the issue of not using Secrets Manager in AWS, you can follow the below steps using AWS CLI:

First, create a new Secrets Manager secret for the sensitive data that needs to be stored securely.
Then, update the application code to retrieve the sensitive data from Secrets Manager instead of being hardcoded in the code.
Next, remove any sensitive data that is currently stored in environment variables or configuration files.
Finally, update the IAM policies to grant the necessary permissions to access the Secrets Manager secret.

To create a new Secrets Manager secret using AWS CLI, follow these steps:

Open the AWS CLI and run the following command to create a new secret:

aws secretsmanager create-secret --name my-secret --secret-string "my-secret-value"

Replace my-secret with the name of the secret you want to create, and my-secret-value with the value of the secret. You can also use the --secret-file option to specify a file containing the secret value.
Once the secret is created, you can update the application code to retrieve the secret value from Secrets Manager.
To remove any sensitive data that is currently stored in environment variables or configuration files, review the code and remove any references to the sensitive data.
Finally, update the IAM policies to grant the necessary permissions to access the Secrets Manager secret. You can use the aws secretsmanager get-secret-value command to retrieve the secret value, so the IAM policy should include the secretsmanager:GetSecretValue action for the relevant resource.

Using Python

To remediate the misconfiguration “Secrets Manager Should Be In Use” for AWS using Python, you can follow these steps:

First, ensure that you have the necessary AWS SDK for Python (Boto3) installed on your system.
Next, you can use the Boto3 SDK to create a Secrets Manager resource in your AWS account. You can do this by creating a new Secrets Manager client object and using the create_secret method to create a new secret.

Here’s some sample Python code that demonstrates how to create a new secret using Boto3:

import boto3

# Create a new Secrets Manager client
client = boto3.client('secretsmanager')

# Create a new secret
response = client.create_secret(
    Name='my-secret',
    SecretString='{"username":"my-username", "password":"my-password"}'
)

# Print the ARN of the new secret
print(response['ARN'])

In this example, we’re creating a new secret named “my-secret” with a username and password stored as a JSON string in the SecretString field.

Once you’ve created your new secret, you can update your application or infrastructure to use the Secrets Manager client to retrieve the secret values at runtime. This will ensure that your secrets are securely stored and managed by AWS.

Here’s some sample Python code that demonstrates how to retrieve a secret using Boto3:

import boto3

# Create a new Secrets Manager client
client = boto3.client('secretsmanager')

# Retrieve the secret value
response = client.get_secret_value(
    SecretId='my-secret'
)

# Print the secret value
print(response['SecretString'])

In this example, we’re retrieving the value of the “my-secret” secret and printing it to the console.By following these steps, you can remediate the misconfiguration “Secrets Manager Should Be In Use” for AWS using Python and ensure that your secrets are securely managed by AWS.

Using Terraform

# Use Secrets Manager in the account, encrypted with a customer-managed KMS key.

resource "aws_kms_key" "secrets_manager_cmk" {
  description             = "CMK for encrypting Secrets Manager secrets"
  deletion_window_in_days = 30
  enable_key_rotation     = true

  tags = {
    Name = "SECRETS_MANAGER_CMK_NAME" # replace with a descriptive name, e.g. "prod-secrets-cmk"
  }
}

resource "aws_secretsmanager_secret" "app_db_credentials" {
  name        = "SECRET_NAME" # e.g. "prod/app/db_credentials"
  description = "Database credentials for APP_NAME" # replace APP_NAME
  kms_key_id  = aws_kms_key.secrets_manager_cmk.arn

  tags = {
    Environment = "ENVIRONMENT" # e.g. "prod"
    Application = "APPLICATION_NAME"
  }
}

resource "aws_secretsmanager_secret_version" "app_db_credentials_value" {
  secret_id     = aws_secretsmanager_secret.app_db_credentials.id
  secret_string = jsonencode({
    username = "DB_USERNAME" # do NOT hardcode real credentials in VCS
    password = "DB_PASSWORD"
  })
}

This finding cannot be remediated directly on aws-managementandgovernance-resourcemanager-organization-account; it is satisfied by having at least one Secrets Manager secret in the account, such as the one above encrypted with a KMS CMK.terraform plan should show the creation of one aws_kms_key, one aws_secretsmanager_secret, and one aws_secretsmanager_secret_version, with no replacements of existing resources.

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

Secrets manager in use remediation

Triage and Remediation

Remediation

​Triage and Remediation

​Remediation

​

Triage and Remediation

Remediation