Pages

Subscribe:

Ads 468x60px

Featured Posts

Thursday, August 13, 2020

Privacy Policy

Privacy Policy Privacy Policy

Aruna Karunarathna built the MasonBass app as a Free app. This SERVICE is provided by Aruna Karunarathna at no cost and is intended for use as is.

This page is used to inform visitors regarding my policies with the collection, use, and disclosure of Personal Information if anyone decided to use my Service.

If you choose to use my Service, then you agree to the collection and use of information in relation to this policy. The Personal Information that I collect is used for providing and improving the Service. I will not use or share your information with anyone except as described in this Privacy Policy.

The terms used in this Privacy Policy have the same meanings as in our Terms and Conditions, which is accessible at MasonBass unless otherwise defined in this Privacy Policy.

Information Collection and Use

For a better experience, while using our Service, I may require you to provide us with certain personally identifiable information, including but not limited to none. The information that I request will be retained on your device and is not collected by me in any way.

The app does use third party services that may collect information used to identify you.

Link to privacy policy of third party service providers used by the app

Log Data

I want to inform you that whenever you use my Service, in a case of an error in the app I collect data and information (through third party products) on your phone called Log Data. This Log Data may include information such as your device Internet Protocol (“IP”) address, device name, operating system version, the configuration of the app when utilizing my Service, the time and date of your use of the Service, and other statistics.

Cookies

Cookies are files with a small amount of data that are commonly used as anonymous unique identifiers. These are sent to your browser from the websites that you visit and are stored on your device's internal memory.

This Service does not use these “cookies” explicitly. However, the app may use third party code and libraries that use “cookies” to collect information and improve their services. You have the option to either accept or refuse these cookies and know when a cookie is being sent to your device. If you choose to refuse our cookies, you may not be able to use some portions of this Service.

Service Providers

I may employ third-party companies and individuals due to the following reasons:

  • To facilitate our Service;
  • To provide the Service on our behalf;
  • To perform Service-related services; or
  • To assist us in analyzing how our Service is used.

I want to inform users of this Service that these third parties have access to your Personal Information. The reason is to perform the tasks assigned to them on our behalf. However, they are obligated not to disclose or use the information for any other purpose.

Security

I value your trust in providing us your Personal Information, thus we are striving to use commercially acceptable means of protecting it. But remember that no method of transmission over the internet, or method of electronic storage is 100% secure and reliable, and I cannot guarantee its absolute security.

Links to Other Sites

This Service may contain links to other sites. If you click on a third-party link, you will be directed to that site. Note that these external sites are not operated by me. Therefore, I strongly advise you to review the Privacy Policy of these websites. I have no control over and assume no responsibility for the content, privacy policies, or practices of any third-party sites or services.

Children’s Privacy

These Services do not address anyone under the age of 13. I do not knowingly collect personally identifiable information from children under 13. In the case I discover that a child under 13 has provided me with personal information, I immediately delete this from our servers. If you are a parent or guardian and you are aware that your child has provided us with personal information, please contact me so that I will be able to do necessary actions.

Changes to This Privacy Policy

I may update our Privacy Policy from time to time. Thus, you are advised to review this page periodically for any changes. I will notify you of any changes by posting the new Privacy Policy on this page.

This policy is effective as of 2020-08-13

Contact Us

If you have any questions or suggestions about my Privacy Policy, do not hesitate to contact me at sujithucsc@gmail.com.

This privacy policy page was created at privacypolicytemplate.net and modified/generated by App Privacy Policy Generator

Wednesday, February 27, 2019

AWS Secret Manager - Protect Your Secrets in Applications

Many applications use secrets for various use cases. Using an application ID and Secret key to generate a token or maybe the secret key itself to access APIs, a username and password to create a database connection string to retrieve data from RDS. Maybe there are various security measurements and standards you’ve been enforced by your organization. One thing for sure is not storing passwords in configuration files or hard code them in plain texts. Storing and retrieving those secrets/passwords in a secure manner can be a challenging task and in this post we are going to discuss a more robust solution using AWS services.

You’ll be need a AWS account setup to follow this tutorial. Then log into your AWS console and locate Secrets Manager service under the Security, Identity and Compliance category.  Click on the “Store a new Secret”. You’ll get three options,

 1. Credentials for RDS database
 2. Credentials for other database
 3. Other Type of Secrets.

Option 1 and 2 dedicate for database credentials, We’ll select the “Other type of secrets” option since this post we going to demonstrate a more generalized solution. Now add your secrets to store securely. Use the DefaultEncryptionKey option for the demo purpose.

Hit Next and add a meaningful name for “Secret Name”, we will be using this to retrieve secrets in the application. Other options are optional and you can proceed.


Hit Next and you’ll get an option to enable Automatic rotation of the keys via a lambda function, lets keep the automated key rotation disabled and proceed to next step. Finally you’ll be redirected to the review and create step. Important thing in this step is you’ll get sample code snippets for Java, JavaScript, C#, Python 3, Ruby and Go languages.

Following is a java code snippet generated for our newly created “blog-sample” secret.

// Use this code snippet in your app.
// If you need more information about configurations or implementing the sample code, visit the AWS docs:
// https://docs.aws.amazon.com/sdk-for-java/v1/developer-guide/java-dg-samples.html#prerequisites

public static void getSecret() {

    String secretName = "blog-sample";
    String region = "us-east-1";

    // Create a Secrets Manager client
    AWSSecretsManager client  = AWSSecretsManagerClientBuilder.standard()
                                    .withRegion(region)
                                    .build();
    
    // In this sample we only handle the specific exceptions for the 'GetSecretValue' API.
    // See https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_GetSecretValue.html
    // We rethrow the exception by default.
    
    String secret, decodedBinarySecret;
    GetSecretValueRequest getSecretValueRequest = new GetSecretValueRequest()
                    .withSecretId(secretName);
    GetSecretValueResult getSecretValueResult = null;

    try {
        getSecretValueResult = client.getSecretValue(getSecretValueRequest);
    } catch (DecryptionFailureException e) {
        // Secrets Manager can't decrypt the protected secret text using the provided KMS key.
        // Deal with the exception here, and/or rethrow at your discretion.
        throw e;
    } catch (InternalServiceErrorException e) {
        // An error occurred on the server side.
        // Deal with the exception here, and/or rethrow at your discretion.
        throw e;
    } catch (InvalidParameterException e) {
        // You provided an invalid value for a parameter.
        // Deal with the exception here, and/or rethrow at your discretion.
        throw e;
    } catch (InvalidRequestException e) {
        // You provided a parameter value that is not valid for the current state of the resource.
        // Deal with the exception here, and/or rethrow at your discretion.
        throw e;
    } catch (ResourceNotFoundException e) {
        // We can't find the resource that you asked for.
        // Deal with the exception here, and/or rethrow at your discretion.
        throw e;
    }

    // Decrypts secret using the associated KMS CMK.
    // Depending on whether the secret is a string or binary, one of these fields will be populated.
    if (getSecretValueResult.getSecretString() != null) {
        secret = getSecretValueResult.getSecretString();
    }
    else {
        decodedBinarySecret = new String(Base64.getDecoder().decode(getSecretValueResult.getSecretBinary()).array());
    }

    // Your code goes here.
}


If you check the code you can see that, it is using the “secretName” and the stored “region” to fetch the secret data.



You can use either the secret name or secret ARN to retrieve the secrets. Now let’s try our sample code in our local environment to access secrets values.
1. To run the sample locally you need to configure the AWS CLI, using [a]

[a]. https://docs.aws.amazon.com/cli/latest/userguide/cli-chap-configure.html

2. Add the following maven dependency.
      
            com.amazonaws
            aws-java-sdk-secretsmanager
            1.11.502
       

 3. Build the project using following command
mvn clean install
4. Run the assembly plugin
mvn assembly:single
5. Run the uber jar using following command
java -jar target/aws-secrets-manager-test-1.0-SNAPSHOT-jar-with-dependencies.jar

You’ll get the secret as following in decrypted manner.

Now you learned,how to store secrets using AWS Secrets Manager and retrieve them in your Applications. But there is a catch here, when configuring the AWS CLI tool you have to store the AWS Access Key ID and the AWS Secret Access Key, which is not the best practice to host them in the AWS EC2 servers. If  a server is compromised, the intruder can easily pick your AWS credentials stored in the ~/.aws/credentials file.

Overcome the storing of Secret Keys

In above use-case, we have to hard code AWS credentials, which is not recommended. Let’s spin up a  ec2 instance and copy our sample app and see whether we can access the secrets we stored in the AWS Secrets Manger.

1. Spin up a ec2 t2 micro instance.
2. Then copy the sample application to the new ec2 server.
scp -i ec2.pem ~/code-base/aws-secrets-manager-test/target/aws-secrets-manager-test-1.0-SNAPSHOT-jar-with-dependencies.jar ec2-user@ip-address:/home/ec2-user
3. Install java in your ec2 instance.
    sudo yum install java-1.8.0-openjdk
4. Run the application
java -jar aws-secrets-manager-test-1.0-SNAPSHOT-jar-with-dependencies.jar

You’ll be ended up with the following error.

It complains that you don’t have the AWS-ACCESS_KEY and AWS_SECRET_KEY unable to load AWS credentials.

Overcome the issue using IAM roles.

Now lets create an IAM role so that my ec2 instance can access the AWS Secrets Manager and retrieve the stored secret values.

1. Go to Services -> IAM -> Roles → Create Role.
2. Select type of trusted entity as AWS service
3. Select EC2
4. Hit Next- Permissions.
5. Search for the permission policy “SecretsManagerReadWrite” and select.
6. Hit Next-Tags.
7. Add tags if you need hit Next.
8. Give a role name and hit Create Role.


Note - It would be if you can create a more granualar role, which can only read the AWS Secrets Manager, since the “SecretsManagerReadWrite” policy has more permissions than we required.
Next Goto → Services → EC2 → Instances → Actions → Instance Settings → Attach/Repalce IAM Role



Select the newly created role and apply.

Now let’s try to run our sample application copied to the AWS EC2 instance. You should be able to read the secrets.



So in this post we have discussed an important aspect of storing and retrieving secrets required for you applications. Since as per my experience this has become a chicken and egg problem, when comes to security the secrets and securing the master key which secure those secrets. I think using the Role approach will help to overcome this problem.

Please add your comments/thoughts if you think there are better ways to overcome this :) Sample Code Link