When user enter their API token on the browser, I need securely save their token. What is good approach to encrypt user's token?
I wax considering using AWS Secrets Manager to store User's token through API but it turn out it is really expensive. $0.40 per secret per month.
I might consider encrypting user token in the MySQL and store master secret in the .env file
Is there alternative approach?
Since you're already using AWS services it makes sense to take advantage of more resilient cloud-native solutions.
With SSM you only pay for your underlying AWS resources managed or created by AWS Systems Manager, however, parameter store as well as the majority of other AWS services using KMS for decryption and encryption purposes.
Additional alternatives:
Based on your usage you will need to do the math, KMS is not free, but has a decent monthly free tier
For your scenario, you can save the token AWS DynamoDB, encrypted at rest with AWS KMS.
In addition to the Lambda charges, AWS KMS will mainly cost $1 for CMK, and based on the on-demand encryption and decryption operations about $0.03 per 10,000 requests and the free tier will give 20,000 requests/month free of charge.
For more details about pricing, refer AWS KMS pricing section.
