Hacker News Reader

Comment by scarface74 | Hacker News Reader

AWS’s secret manager seems like overkill for most projects and it’s expensive - 40 cents per secret per month. The Parameter Store is free and much better integrated with AWS’s other offerings. It also supports encrypted values.

View on HN

(I do work for AWS)

I was confused by the naming convention at launch, but a secret is a set of key value pairs and not a single key value pair.

I’m looking at the Boto3 docs. It looks like a “secret” is a single key where the value can be JSON text that is a key value pair. Parameter Store let’s you use do a simple key value pair. Am I missing something?

Who says the value needs to represent a scalar value? Why not encode an encrypted JSON string as the value.

It kind of defeats the purpose if you are sharing common setting across services, if you only need one value shared.

Ouch, that is very expensive indeed. Normally AWS has decent prices but this seems way too much per secret.

I imagine parameter store keeps values non-encrypted while secret manager values end up encrypted by a HSM, without the cost of cloudHSM.

One of the options when you are adding a parameter is “securestring”. It uses AWS KMS to encrypt your parameter.

https://docs.aws.amazon.com/kms/latest/developerguide/servic...

Have you looked at what hashicorp charges for vault? It's like $150k per cluster.

Vault is free and open source. Only the “Enterprise” version cost money. I’ve used the open source versions of Consul, Nomad, and Vault before for on prem implementation.

> Only the “Enterprise” version cost money.

Which is what we are comparing here. Enterprise with enterprise. Features equivalency.

What does the Enterprise version give you that makes it closer to being equivalent to AWS’s secrets manager?

Customer support.

HSM support and cross-region replication.

We use parameter store, the thing that makes me nervous about it is there's no SLA on it. As it's free, what incentive do they have to improve it?

Additionally they might just retire it in favour of the secrets manager soon anyway. I bet the pricing on that would drop at that point too

Hey. I work for AWS.

Parameter Store isn’t going away and is still under active development.

So it looks more like a KMS system than let's say Chef Vault

Reply on news.ycombinator.com