Show HN: A self-hosted, AWS-based secrets manager | Hacker News Reader

Show HN: A self-hosted, AWS-based secrets manager

embrasure.dev

24 points_r5xp34 comments

Feedback: you need to state very clearly, high up on the page WHY someone would want to use a non-managed solution vs SecretsManager or SSM Parameter Store.

The website has way too much information that is basic credentials store 101. I know why I’d want a secrets manager already.

and if you are targeting users/builders on AWS (which you are implicitly if you can’t run off AWS) you need to be clear as to why anyone would waste time with an unmanaged solution

That's a fair point. Thanks for the feedback!

> Embrasure is an open-source, self-hosted secrets management tool built on Amazon Web Services (AWS) for small teams seeking simplicity and security.

Was excited to hear about self-hosted secrets management, but expected "self-hosted" to mean I can host anywhere, but the depends specific AWS features.

Perhaps "unmanaged" is a more appropriate term.

> expected "self-hosted" to mean I can host anywhere

You're referring to a cloud-agnostic solution.

Embrasure is self-hosted since each instance is deployed within an organization's infrastructure, but as you mentioned, it's AWS-dependent.

> You're referring to a cloud-agnostic solution.

I actually mean that the service need not care if it's in the cloud or on-premise as opposed to whose cloud. Many of my services don't need to do anything in the cloud.

If you look at things like awesome-selfhosted[0] you'll see that this is the prevailing expectation of things describing themselves as "self-hosted".

[0] https://github.com/awesome-selfhosted/awesome-selfhosted

Based on a strict definition, I agree that Embrasure may not be considered self-hosted, but I don't think that's the "prevailing expectation."

For example, look at Infisical's documentation[0], and you'll see they offer self-hosting solutions on AWS, GCP, Azure, and more.

[0]https://infisical.com/docs/self-hosting/overview

Self-hosting does not mean you can't run it on AWS, but people expect more. Just look at Postgresql as an example of a self hosted software. You can run it in the cloud or your own basement.

Postgresql is a great example.

I don’t think we should go down that rabbit hole of redefining self hosting ad anything other than host it in your own infra. So if AWS disappeared today, would your product still be self hosted? If being self hosted does not actually depend on your product but on the availability of another provider, there I don’t think we should call it self hosted.

> Based on a strict definition, I agree that Embrasure may not be considered self-hosted, but I don't think that's the "prevailing expectation."

I wont 100% discount that I live in a bubble, but try ask 100 random people what "self hosted" means, I would strongly guess that very very few says "I can (only) spin up some resources on AWS and deploy it there"

> ask 100 random people

I don't think it should be left to the opinion of 100 "random" people.

I'll quote Wikipedia[0] again: "Self-hosting is the practice of running and maintaining a website or service using a private web server..."

Embrasure is built on a Virtual Private Cloud instance.

https://en.wikipedia.org/wiki/Self-hosting_(web_services)

> I don't think it should be left to the opinion of 100 "random" people.

well judging by the other comments here, you will be getting even less who agree with your definition

No, this is not what self hosted means.

This is a self managed AWS solution; nothing wrong with that.

Contradiction in terms: "self-hosted, AWS-based"

I would disagree. Sure, you don't own the hardware, but you have total control over Embrasure's functionality within your self-contained instance.

Wikipedia: "Self-hosting is the practice of running and maintaining a website or service using a private web server, instead of using a service outside of someone's own control."

Yes, correct, AWS Secrets Manager is out of your own control. You don't control it. AWS does. They can change it or even end it as a product any day they like.

and they can also end all their other services on a whim. Are they gonna do it? dont think so, but they could

The point remains though that AWS is not self-hosting.

exactly my point aswell, or atleast that it cannot be limited to AWS

AWS Secrets Manager is another AWS-based secrets manager

True, but it doesn't have a program wrapper and isn't part of the AWS Free tier.

For a lot of teams, it's a better choice than Embrasure, but Embrasure serves its use case well and all of its components can be deployed with AWS's free plan.

This is another reason why I'm happy using ECS. You just reference the keys in the task definition, and secrets from Parameter Store (or Secrets Manager, if you want the added cost and advantages like secrets rotation) are injected when the task starts.

Why not the SSM parameter store?

SSM is a great alternative, but it's a managed solution. Embrasure is self-hosted.

Thanks for your reply, but as far as I read the documentation, your solution relies on AWS. If so, manged vs self-hosted is not really an issue since you are already locked into AWS. If it works without AWS, then it makes sense.

It’s self managed, AWS is hosting it.

This may seem like nit picking, but I can assure you confusing your audience will hamper the success of your project if you are aiming for growth.

I do wonder why OP is so set on calling it self hosted, when it seems quite obvious that more or less nobody has the same definition of self hosted

I try my best to avoid secrets and leverage aws-iam-auth or SPIFFE/SPIRE where at all possible.

I agree this is generally a good idea, but sometimes you can't avoid using secrets. Right?

Interesting how it manages IAM roles. I think lambda is a cool choice over EC2 as well.

This is really cool - what did you use for the diagrams?

Thanks! We used Adobe and svgrepo.com for vectors.

Reply on news.ycombinator.com