credstash
A simple credential management and distribution system using AWS KMS for encryption and DynamoDB for storage.
What is credstash?
CredStash is a command-line utility for securely storing and retrieving secrets like database passwords and API keys in AWS environments. It solves the problem of credential management by using AWS KMS for encryption and DynamoDB for storage, providing a simple alternative to ad-hoc solutions like SCP'ing files or hardcoding secrets in version control.
DevOps engineers, cloud administrators, and developers working on AWS who need a straightforward way to manage and distribute credentials across their infrastructure without building a custom secrets management system.
Developers choose CredStash for its simplicity, tight integration with AWS services, and minimal setup overhead. It offers robust security using KMS and DynamoDB, versioning for credential rotation, and fine-grained access control through encryption contexts, all without requiring complex infrastructure.
Overview
A little utility for managing credentials in the cloud
Use Cases
Best For
- Storing database passwords for web applications deployed on AWS
- Managing API keys for third-party services in cloud environments
- Securely distributing secrets to EC2 instances using IAM roles
- Implementing credential rotation with versioning support
- Auditing secret access via CloudTrail logs with encryption context
- Controlling access to secrets using KMS key policies and IAM conditions
Not Ideal For
- Multi-cloud or hybrid cloud environments where AWS services are not available or desired
- High-throughput applications requiring frequent secret updates, due to DynamoDB provisioned throughput costs and latency
- Teams needing a graphical user interface or web dashboard for secret management, as it's CLI-only
- Projects with strict security requirements that prohibit any risk of credential exposure via memory dumps, since Python processes could be vulnerable
Pros & Cons
Pros
Leverages AWS KMS for master key storage in HSM-backed storage and DynamoDB for encrypted credential storage, ensuring industry-standard encryption without manual key management.
Supports credential rotation through immutable versions with auto-incrementing options, as detailed in the README's versioning section, allowing seamless updates without breaking changes.
Uses KMS encryption context for auditing via CloudTrail and controlling access through IAM policies, enabling per-secret permission scopes and compliance tracking.
Offers community-maintained libraries for Java, Ruby, Go, and others, as listed in the README, facilitating integration into diverse tech stacks beyond Python.
Cons
Tightly coupled to AWS KMS and DynamoDB, making migration to other clouds or on-premises systems difficult and limiting flexibility in multi-provider setups.
Requires manual installation of build tools and libraries like libssl-dev on Linux, as noted in the README, adding setup complexity compared to other platforms.
Security boundary is the EC2 instance; the README warns that any user with access to instance metadata or memory dumps can potentially retrieve credentials, posing risks in shared environments.
Users from before December 2015 need to run a migration script for auto-versioning due to unpadded integers causing sorting errors, indicating past breaking changes and maintenance overhead.
Frequently Asked Questions
Related Projects
SopsSimple and flexible tool for managing secrets
Git SecretsPrevents you from committing secrets and credentials into git repositories
aws-vaultA vault for securely storing and accessing AWS credentials in development environments
gopassThe slightly more awesome standard unix password manager for teams
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.