Go to Roles, create a Role with an access rule that grants access to the resource, and assign the Role to the User.If the secret you are storing is a certificate, you should Base64-encode it, and then enter the path as follows when setting up a resource to use it: example-secret?key=certificate&encoding=base64. It is preferred that certificates be Base64-encoded.If using JSON, add the key along with the path to the credential, (e.g., example-secret?key=username). AWS accepts plaintext secrets, which you would use to store one credential field per secret, or you can write out JSON secrets in the field, which could include many credential values with different keys.Select the AWS Secrets Store you created for the Secret Store field, and then fill in the path to the secrets that you’ve stored in your secret store.Fill out the information for a resource whose credentials you have stored in your secret store.In the Admin UI, add a new resource such as a Server or Datasource and choose the AWS Secrets Manager Secret Store type.Now, create a resource that uses the secret store, assign it to a Role that is assigned to a User, and verify that you can connect. If you’ve configured the Relay server correctly for secret store access and authorization, you will see the green online indicator. Region: Fill the AWS region (e.g., us-west-2) for your AWS Secrets Manager.Secret Store Type: Select AWS Secrets Manager.On the Add Secret Store form, set the following: In the Admin UI, go to Network > Secret Stores. Once you have AWS Secrets Manager set up, credentials stored, and your Relay server able to access said credentials, it’s time to integrate the secret store with strongDM.

Restart the sdm-proxy service (with something like sudo systemctl restart sdm-proxy, depending on your distribution).Ĭonfigure the Secret Store with the Admin UI # Get an access key for AWS and set the necessary environment variables on your Relay server ( AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY).Įdit the file /etc/sysconfig/sdm-proxy (unless you have moved or renamed your sdm-proxy file) and add the following lines, substituting your ID and key: AWS_ACCESS_KEY_ID=aswf234rt4rsag4t3gĪWS_SECRET_ACCESS_KEY=23452321h2893hf2ioufh2938229fh2oufgh23890fh29fh23bif2f0928hf02f3n2bf290fn9230f

Choose the name of the IAM role created earlier.

Select the instance that houses the Gateway, and click on Actions > Security > Modify IAM Role.

Add the role name and description, and then go to EC2 and click on Instances.In the policy, select SecretsManagerReadWrite, and click Next.In your AWS Management Console, navigate to IAM, click on Role, and click on Create Role.

You can authenticate your Gateway server with AWS in one of two ways. Either way, when asked for the path to your secret later, this name is that path. You may choose to organize your credentials by slug (e.g., postgres) or namespace/path (e.g., /credentials/databases/postgres).

Aws secrets manager