53 lines
2.2 KiB
Markdown
53 lines
2.2 KiB
Markdown
---
|
||
title: "CTP Topic 37 Secrets Certificates Management"
|
||
type: source
|
||
tags:
|
||
- AWS
|
||
- Secrets-Manager
|
||
- Certificates
|
||
- Security
|
||
- CTP
|
||
date: 2026-04-14
|
||
---
|
||
|
||
## Source File
|
||
- [[raw/Cloud & DevOps/Public-Cloud-Learning-Sessions/07_Security/ctp-topic-37-secrets-certificates-management.md]]
|
||
|
||
## Summary
|
||
- 核心主题：云转型项目中的密钥与证书管理方案选型与实施
|
||
- 问题域：企业级 secrets 管理工具评估与标准化
|
||
- 方法/机制：AWS Secrets Manager、HashiCorp Vault、CyberArk PAM 三方案对比，30天试点验证
|
||
- 结论/价值：选择 AWS Secrets Manager 作为企业标准，集成 Control Tower 实现 CI/CD 流程中的密钥自动化管理
|
||
|
||
## Key Claims
|
||
- AWS Secrets Manager 与 AWS RDS、Redshift、DynamoDB 有内置集成，支持高可用和灾备
|
||
- HashiCorp Vault 免费版缺乏企业级能力（高可用、多租户）
|
||
- AWS Secrets Manager 在账户级别管理密钥，可降低成本并提升安全性
|
||
|
||
## Key Quotes
|
||
> "AWS Secrets Manager is easy and simple to implement."
|
||
> "The pilot phase included HashiCorp Vault and AWS Secrets Manager."
|
||
> "Implementation phase involves removing clear text passwords and keys from CI/CD processes, starting with Control Tower."
|
||
|
||
## Key Concepts
|
||
- [[Secrets Management]]：数字认证凭证、密钥、API Token 等敏感信息的管理
|
||
- [[Secret Rotation]]：自动轮换密钥以提升安全性的机制
|
||
- [[CI/CD Secrets Management]]：在持续集成/部署流程中安全管理密钥
|
||
|
||
## Key Entities
|
||
- [[AWS]]：云服务提供商，Secrets Manager 所属平台
|
||
- [[AWS Secrets Manager]]：AWS 托管的密钥管理服务
|
||
- [[HashiCorp Vault]]：自托管密钥管理工具
|
||
- [[CyberArk PAM]]：特权访问管理解决方案
|
||
- [[AWS Control Tower]]：AWS 账户治理服务
|
||
|
||
## Connections
|
||
- [[AWS Secrets Manager]] ← chosen_as ← [[Secrets Management]]
|
||
- [[AWS Control Tower]] ← implements ← [[CI/CD Secrets Management]]
|
||
- [[AWS]] ← provides ← [[AWS Secrets Manager]]
|
||
|
||
## Contradictions
|
||
- 与 [[CTP Topic 62 AWS Secrets Manager]] 冲突：
|
||
- 冲突点：两份文档都涉及 AWS Secrets Manager
|
||
- 当前观点：本文描述选型过程，Topic 62 描述实施细节
|
||
- 对方观点：Topic 62 聚焦分阶段实施方法和 JDBC Wrapper 无密码登录 |