Storing/Rotating Credentials for a SQL Server on EC2 with AWS Secrets Manager (Looking for Simpler Methods)

0

This blog post "https://aws.amazon.com/blogs/apn/how-helecloud-used-aws-secrets-manager-to-automate-credentials-rotation-of-ms-sql-on-amazon-ec2/" describes a solution for automating credential rotation for a Microsoft SQL Server database on an Amazon EC2 instance using AWS Secrets Manager and AWS Systems Manager Run Command.

While the approach achieves its goal, it involves several steps and external tools. Considering it's been over four years since the post was published, I'm wondering if there are simpler or more current methods available for this task.

Can anyone share insights on simpler or more recommended approaches for rotating/storing credentials for a SQL Server on EC2 via secrets manager or parameter store in 2024?

1 Answer
0

Hello,

You can rotate database secrets in AWS secrets manager using Lambda function, Here is the documentation explaining the same: https://docs.aws.amazon.com/secretsmanager/latest/userguide/rotate-secrets_turn-on-for-db.html

and example AWS Secrets Manager rotation Lambda function templates: https://docs.aws.amazon.com/secretsmanager/latest/userguide/reference_available-rotation-templates.html

You would still must ensure the Application running in EC2 can retrieve the database credential from Secrets Manager instead of hard coding this information in a configuration file or source code.

References:

https://aws.amazon.com/blogs/security/rotate-amazon-rds-database-credentials-automatically-with-aws-secrets-manager/

profile picture
EXPERT
answered a month ago
profile pictureAWS
EXPERT
reviewed a month ago
  • Hi there,

    Thanks for the information on rotating secrets in AWS Secrets Manager using a Lambda function! That's definitely a valuable resource for future reference.

    However, my primary concern is a bit different. there isn't a native integration between AWS Secrets Manager and Microsoft SQL Server agent on EC2. My goal is to find a simpler way to store and manage credentials for this specific scenario.

    Do you have any insights on simpler approaches for storing credentials in AWS Secrets Manager (or even AWS Parameter Store) that can be accessed by a Microsoft SQL Server agent on EC2? Perhaps a custom script or leveraging managed instance identities could be an option?

    I appreciate your help in understanding the available options!

  • What are your experiences or recommendations for simpler approaches to store and manage SQL Server Agent credentials on EC2 using AWS services?