0

I am building a lamp server ec2 image for a project we are doing. These images will be in an autoscaling group and on startup will be running startup script. THere are some config files that have details that need to be kept secure, for example database login details.

I was originally planning to run a phpscript to retrieve these files from an S3 bucket, however when I was reading about credentials for the instance to access the S3 server, the documentation advised that the security credentials should not be stored on S3, even if it is encrypted. I'm not using a credential file anyway, as I have assigned a IAM role to the ec2, however, this advice has made me think, well it's not secure to store these config files on S3 also.

So I'm just asking, what is the best practice for storage of config files for instances that have to be spun up. Should I just make these config files part of the image I'm creating? Or is there a reason I should not do that either?

Thanks.

Improve this question

1 Answer 1

Reset to default
1

You can store the config file in S3, the Secrets in parameter store (they can be encrypted at rest) and inject the parameters in your config file (with sed in bash for example).

I won't advice to directly store them inside your EC2 (I mean EBS) because anybody having the right to mount the EBS could have access to them.

Improve this answer
3
  • so you mean run a script on startup of the ec2 instance that uses sed to retrieve the file from S3? Or are you saying I can use sed in bash from the S3 side? Also the funny thing is, when I was reading about using the php sdk to access objects from buckets on S3, it said any application on your ec2 that wants to use some other aws service must have credentials. One way of having credentials is having the credentials in a file and the documentation said, don't store these credentials on S3, even if it was encrypted. So I'm wondering if it's ok to store a config file on there?
    – Bucephalus
    Commented Jan 10, 2019 at 21:52
  • You retreive the file on S3, save it somewhere and use sed. I don't know if PHP SDK can use instance profile: you can attach an IAM role to an EC2 instance. Like this, you don't store credentials anywhere.
    – Kaymaz
    Commented Jan 11, 2019 at 8:54
  • Yes you can assign a role tot he instance for the php sdk to use temporary credentials. This is how they prefer it, rather than the other methods. Yes, I was just highlighting the point that aws do not what you to store credentials on S3, so I was wondering if that would go for other sensitive data, that's all. Thanks for your help.
    – Bucephalus
    Commented Jan 11, 2019 at 14:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .