A simple credential management and distribution system using AWS KMS for encryption and DynamoDB for storage.
CredStash is a command-line utility for securely storing and retrieving secrets like database passwords and API keys in AWS environments. It solves the problem of credential management by using AWS KMS for encryption and DynamoDB for storage, providing a simple alternative to ad-hoc solutions like SCP'ing files or hardcoding secrets in version control.
DevOps engineers, cloud administrators, and developers working on AWS who need a straightforward way to manage and distribute credentials across their infrastructure without building a custom secrets management system.
Developers choose CredStash for its simplicity, tight integration with AWS services, and minimal setup overhead. It offers robust security using KMS and DynamoDB, versioning for credential rotation, and fine-grained access control through encryption contexts, all without requiring complex infrastructure.
A little utility for managing credentials in the cloud
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Leverages AWS KMS for master key storage in HSM-backed storage and DynamoDB for encrypted credential storage, ensuring industry-standard encryption without manual key management.
Supports credential rotation through immutable versions with auto-incrementing options, as detailed in the README's versioning section, allowing seamless updates without breaking changes.
Uses KMS encryption context for auditing via CloudTrail and controlling access through IAM policies, enabling per-secret permission scopes and compliance tracking.
Offers community-maintained libraries for Java, Ruby, Go, and others, as listed in the README, facilitating integration into diverse tech stacks beyond Python.
Tightly coupled to AWS KMS and DynamoDB, making migration to other clouds or on-premises systems difficult and limiting flexibility in multi-provider setups.
Requires manual installation of build tools and libraries like libssl-dev on Linux, as noted in the README, adding setup complexity compared to other platforms.
Security boundary is the EC2 instance; the README warns that any user with access to instance metadata or memory dumps can potentially retrieve credentials, posing risks in shared environments.
Users from before December 2015 need to run a migration script for auto-versioning due to unpadded integers causing sorting errors, indicating past breaking changes and maintenance overhead.