9

My elastic beanstalk app has a number of environment variables that are confidential (e.g. API keys, hashing secrets etc.). I would like to setup AWS so that most developers can view and edit config etc, but can't see some of these environment variables. It would be a large overhead if we had to change all of these each time a developer leaves, for example.

From playing about with permissions, it seems (with Elastic Beanstalk at least) you can either have complete access to the config or can't see any of it - and removing access entirely would mean a developer can't even do basic things like see why a deployment failed.

I'm wondering if there's another approach to environment variables that might allow me to give devs access to this config, but obscure the highly confidential stuff. Could I put secret env vars in a file on the server?

Is there another way of doing this?

2
  • 1
    you can check the vault for storing the secrets and passwords. we use vault to store the AWS creds , for more info on vault refer vaultproject.io .
    – Amit
    Dec 22, 2016 at 12:46
  • Oh great find! Will do some Christmas reading...
    – MDalt
    Dec 22, 2016 at 12:49

3 Answers 3

4

This is how I have used EB environemnt variables for setting RDS password

$(aws secretsmanager get-secret-value --secret-id arn:aws:secretsmanager:eu-central-1:<aws-account-id>:secret:<secret-arn> --region eu-central-1 | jq --raw-output '.SecretString' | jq -r .password)

Password is stored in AWS Secrets Manager as json

{
  "username": "<db-user>",
  "engine": "mysql",
  "dbname": "<db-name>",
  "host": "<rds-host-name>.eu-central-1.rds.amazonaws.com",
  "password": "<password>",
  "port": 3306,
  "dbInstanceIdentifier": "<db-identifier>"
}

RDS password set in Elastic Beanstalk as environment variable

1
  • this is what I have been looking for for about two hours. YOu can inject secrets directly into Elastic Beanstalk from the "Environment Properties" area? If you wanted to do it secret by secret would that work (aka - not JSON)?
    – Jim M
    Aug 9, 2021 at 0:38
1

One way of approaching this is using the IAM role of your Elastic Beanstalk EC2 instance. You could store information in a resource that is not accessible by your developers but can be accessed by the EC2 instance because it assumes a certain role.

Amazon has a blog post on how to do this using an S3 encrypted bucket and AWS KMS to store the encryption key. This is about using it for Docker containers in the EC2 Container Service but the principle is the same.

0

I found a way to hide all variables using a custom IAM policy to deny describing the elastic beanstalk environments

It's not a full version, but add it to your policy.

    {
        "Effect": "Allow",
        "Action": [
            "elasticbeanstalk:DescribeApplications",
            "elasticbeanstalk:DescribeEnvironments",
            "elasticbeanstalk:DescribeEnvironmentManagedActionHistory",
            "elasticbeanstalk:DescribePlatformVersion",
            "elasticbeanstalk:DescribeEnvironmentResources"
        ],
        "Resource": "*"
    },
    {
        "Effect": "Allow",
        "Action": [
            "elasticbeanstalk:ListPlatformVersions"
        ],
        "Resource": "*"
    },
    {
        "Effect": "Deny",
        "Action": [
            "elasticbeanstalk:Update*",
            "elasticbeanstalk:Create*",
            "elasticbeanstalk:Delete*",
            "elasticbeanstalk:RestartAppServer",
            "elasticbeanstalk:SwapEnvironmentCNAMEs",
            "elasticbeanstalk:DescribeConfigurationSettings",
            "elasticbeanstalk:TerminateEnvironment"
        ],
        "Resource": "*"
    }
]

}

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.