Retrieving secrets from AWS with C# without storing access credentials in code base

Viewed 889

I want to store sensitive data in my .Net Core C# app in AWS secret manager. I have created my secret in the portal but when I try to access it with the following code:

var config = new AmazonSecretsManagerConfig
{
    ProxyHost = "MyProxyHost",
    ProxyPort = 8080,
    ProxyCredentials = CredentialCache.DefaultCredentials,
    Timeout = TimeSpan.FromMinutes(5),
    MaxErrorRetry = 1,
    RegionEndpoint = RegionEndpoint.MyRegion,
};

var client = new AmazonSecretsManagerClient(config);

I then get this message when trying to use the secret manager client:

Unable to get IAM security credentials from EC2 Instance Metadata Service

This is unsurprising as I haven't given any information that indicates I should be able to access secrets manager. I can gain access with the following code:

var config = new AmazonSecretsManagerConfig
{
    ProxyHost = "MyProxyHost",
    ProxyPort = 8080,
    ProxyCredentials = CredentialCache.DefaultCredentials,
    Timeout = TimeSpan.FromMinutes(5),
    MaxErrorRetry = 1,
    RegionEndpoint = RegionEndpoint.MyRegion,
};

var client = new AmazonSecretsManagerClient("MyAWSAccessKeyId", "MyAWSSecretAccessKey", config);

This though means that I have to store my sensitive data in my application, which is what I wanted to avoid in the first place. In Azure, using KeyVault this could be avoided using the right NuGet package and managed identities. I am wondering if there is a similar solution for AWS for both applications hosted in AWS and local development?

1 Answers
Related