# Copy of Application Configuration & Credential Security

### **📌 Introduction**

🔹 **Application Configuration & Credential Security** ensures that sensitive application configurations, secrets, and credentials are securely managed and protected from unauthorized access.\
🔹 **SecureCart's Goal:** Implement best practices to prevent **credential leaks, unauthorized access, and misconfigurations** in AWS workloads.

✅ **Why is this important?**

* Prevent **exposure of credentials** (database passwords, API keys).
* Ensure **secrets are encrypted** and accessed securely.
* Reduce **attack surfaces** by following **least privilege principles**.

***

## **Key AWS Services for Secure Application Configuration & Credential Management**

| **Service**                                               | **Purpose**                                                                      | **How SecureCart Uses It**                                                               |
| --------------------------------------------------------- | -------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------- |
| **AWS Secrets Manager**                                   | Securely store, manage, and rotate secrets like database passwords and API keys. | SecureCart stores **RDS credentials, API keys, and encryption keys** in Secrets Manager. |
| **AWS Systems Manager Parameter Store**                   | Store and retrieve configuration data securely.                                  | SecureCart uses Parameter Store for **environment variables and app configs**.           |
| **AWS IAM Roles & Policies**                              | Control access to AWS resources with least privilege.                            | SecureCart enforces **role-based access** for services and applications.                 |
| **AWS Lambda Environment Variables (Encrypted with KMS)** | Store environment-specific configurations securely.                              | SecureCart encrypts Lambda function **environment variables with KMS**.                  |

***

## **📌 Section 2: Best Practices for Application Configuration Security**

#### **🔹 1. Use IAM Roles Instead of Hardcoding Credentials**

❌ **Bad Practice:** Hardcoding AWS access keys in the application code.\
✅ **Best Practice:** Use **IAM Roles** to grant applications the required permissions dynamically.

✅ **Example:** Assigning an IAM Role to an EC2 instance instead of using access keys:

```sh
shCopyEditaws ec2 associate-iam-instance-profile --instance-id i-xxxxxxxx --iam-instance-profile Name=SecureCartAppRole
```

***

#### **🔹 2. Securely Store Secrets Using AWS Secrets Manager**

**AWS Secrets Manager** is the recommended way to store sensitive credentials like **database passwords, API keys, and tokens**.

✅ **Example: Store a Secret in AWS Secrets Manager**

```sh
shCopyEditaws secretsmanager create-secret --name SecureCartDBPassword \
    --secret-string "SuperSecureP@ssword123"
```

✅ **Example: Retrieve the Secret Securely**

```python
pythonCopyEditimport boto3

client = boto3.client('secretsmanager')
response = client.get_secret_value(SecretId="SecureCartDBPassword")
print(response['SecretString'])
```

📌 **Why SecureCart Uses AWS Secrets Manager?**\
✅ Automatic secret rotation.\
✅ Encrypts stored secrets using **AWS KMS**.\
✅ Access control via **IAM policies**.

***

#### **🔹 3. Use AWS Systems Manager Parameter Store for Non-Sensitive Configurations**

AWS **Systems Manager Parameter Store** is used to store **non-sensitive application configurations** securely.

✅ **Example: Store an Application Configuration Parameter**

```sh
shCopyEditaws ssm put-parameter --name "/securecart/config/db-host" --value "db.securecart.com" --type "String"
```

✅ **Example: Retrieve the Parameter in an Application**

```python
pythonCopyEditimport boto3

ssm_client = boto3.client('ssm')
response = ssm_client.get_parameter(Name="/securecart/config/db-host")
print(response['Parameter']['Value'])
```

📌 **When to Use AWS Systems Manager Parameter Store?**

* **For storing application configurations** (e.g., API endpoints, feature flags).
* **For storing non-sensitive environment variables**.
* **For centralized configuration management**.

***

#### **🔹 4. Encrypt Application Data Using AWS KMS**

**AWS Key Management Service (AWS KMS)** is used to **encrypt application secrets, logs, and sensitive data**.

✅ **Example: Encrypt Data Using AWS KMS**

```sh
shCopyEditaws kms encrypt --key-id "alias/SecureCartKey" --plaintext "SensitiveData"
```

✅ **Example: Decrypt Data in an Application**

```python
pythonCopyEditimport boto3

kms_client = boto3.client('kms')
ciphertext = b'EncryptedDataBlob'
response = kms_client.decrypt(CiphertextBlob=ciphertext)
print(response['Plaintext'])
```

📌 **Why SecureCart Uses AWS KMS?**\
✅ Centralized encryption key management.\
✅ IAM-based access control for encryption and decryption.\
✅ Audit logging via AWS CloudTrail.

***

#### **🔹 5. Use Encrypted Environment Variables for AWS Lambda**

Instead of storing secrets in plain text, **encrypt Lambda function environment variables with AWS KMS**.

✅ **Example: Encrypt Environment Variables in AWS Lambda**

```sh
shCopyEditaws lambda update-function-configuration --function-name SecureCartFunction \
    --environment "Variables={DB_PASSWORD=SuperSecureP@ssword123}" \
    --kms-key-arn arn:aws:kms:region:account-id:key/key-id
```

📌 **Best Practices for Lambda Environment Variables**\
✅ **Use AWS KMS to encrypt secrets**.\
✅ **Do not hardcode database credentials** in Lambda functions.\
✅ **Use IAM Roles instead of access keys** for authentication.

***

## **📌 Section 3: Common Threats & Mitigation Strategies**

| **Threat**                                 | **Mitigation Strategy**                                                                   |
| ------------------------------------------ | ----------------------------------------------------------------------------------------- |
| **Hardcoded Credentials in Code**          | Use **IAM Roles, Secrets Manager, and Parameter Store** instead of embedding credentials. |
| **Leaked API Keys in Public Repositories** | Use **AWS IAM Access Analyzer** to detect and prevent secret leaks.                       |
| **Unencrypted Sensitive Data**             | Encrypt data at rest and in transit using **AWS KMS** and **TLS/SSL**.                    |
| **Overly Permissive IAM Policies**         | Follow **least privilege principle** when granting IAM permissions.                       |

***

## **📌 Section 4: SecureCart Implementation Strategy**

🔹 **How SecureCart Implements Application Configuration & Credential Security** ✅ **Secrets are stored securely in AWS Secrets Manager and rotated automatically**.\
✅ **IAM Roles are used for authentication instead of hardcoded credentials**.\
✅ **Application configurations are stored in AWS Systems Manager Parameter Store**.\
✅ **Data encryption is enforced with AWS KMS**.\
✅ **Lambda function environment variables are encrypted using AWS KMS**.

***

## **📌 Hands-On Lab: Secure Application Secrets & Configurations**

#### **🎯 Goal: Implement a Secure Application Configuration Strategy**

✅ **Store an application secret in AWS Secrets Manager**.\
✅ **Retrieve the secret in an EC2 instance securely**.\
✅ **Use IAM Role instead of hardcoded credentials**.\
✅ **Encrypt an application log file using AWS KMS**.

***

## **📌 Summary**

| **Concept**                  | **AWS Service**                     | **Best Practice**                                            |
| ---------------------------- | ----------------------------------- | ------------------------------------------------------------ |
| **Store Secrets**            | AWS Secrets Manager                 | Rotate secrets automatically, encrypt with AWS KMS.          |
| **Store Configurations**     | AWS Systems Manager Parameter Store | Store non-sensitive application settings securely.           |
| **Encrypt Sensitive Data**   | AWS KMS                             | Use IAM-controlled encryption keys for secure data handling. |
| **Use IAM Roles**            | AWS IAM                             | Never hardcode access keys in the application code.          |
| **Protect Lambda Variables** | AWS Lambda + KMS                    | Encrypt sensitive environment variables.                     |

✅ **Following these best practices ensures that SecureCart applications remain secure and compliant.**

#### **Scenario:**

SecureCart’s developers need **secure access to application credentials** for databases and APIs **without hardcoding secrets** in code.

#### **Key Learning Objectives:**

✅ Store and manage secrets securely using **AWS Secrets Manager & Parameter Store**\
✅ Use **IAM permissions** to restrict access to credentials\
✅ Implement **automatic secret rotation** to enhance security\
✅ Apply **least privilege access control for applications**

#### **Hands-on Labs:**

1️⃣ **Use AWS Secrets Manager to Store & Retrieve Database Credentials**\
2️⃣ **Implement Parameter Store for Application Configurations**\
3️⃣ **Set Up IAM Policies to Restrict Secret Access**

🔹 **Outcome:** SecureCart removes **hardcoded credentials**, ensuring **secure secret management**.