Show HN: Credstash – A tiny python utility for managing secrets in EC2 | Hacker News Reader

Show HN: Credstash – A tiny python utility for managing secrets in EC2

github.com

69 points_alex_14 comments

Why DynamoDB and not, let's say, SimpleDB? I'm sorry but isn't this "tiny" utility coming with huge requirements indeed?

SimpleDB is deprecated, more expensive than DDB, and kind of weird to use. Backing your keystore with a deprecated service just sounds like a road to many sleepless nights ;)

The utility does depend on three external services: DynamoDB, KMS, and IAM (for permissioning). This might sound like a lot, but the target usecase for something like this is a fleet running in the cloud. If you're already running in EC2, then using IAM roles to distribute AWS creds is a no-brainer and very simple. KMS and DDB are also not arduous things to depend on if you're already in the cloud.

For credstash, you need to set up your KMS key (and set whatever policies around it make sense for you). Once you do that, there's nothing to manage. Sure, you depend on DDB, but credstash creates the table for you, and unless you need to dial up more throughput (which is a mouse-click operation), you never have to touch it.

> SimpleDB is deprecated

It actually doesn't appear to be officially deprecated at all, although perhaps it is considered feature complete:

http://aws.amazon.com/simpledb/

However, Amazon seems to ignore questions as to its status which tends to make me wary as well.

The page is still up, and AWS is obviously still running the service (and will as long as customers keep using it), but it's not linked from anywhere. Here's a list of all the AWS services (https://aws.amazon.com/products/) and it's not listed. If you look at the developer guide, it hasn't been updated in three years.

It may not be officially deprecated, but a service tat hasn't been touched in three years, which AWS will only tell you about if asked very specifically, makes me not want to use it as a foundation for any new services.

As far as I recall there was a small update in SimpleDB just a few months ago.

According to the doc revision history: http://docs.aws.amazon.com/AmazonSimpleDB/latest/DeveloperGu... the last update to the developer guide was 2012.

According to the release notes: http://aws.amazon.com/releasenotes/Amazon-SimpleDB the last update to the service was 2011

I'm sure I saw some limit update or something recently. Will dig it out in a bit.

I am sorry, but how can DynamoDB be cheaper when I have to pay to provision capacity and SimpleDB is practically free for low-volume stuff like this? S3 is probably an even better option, which seem to be on the roadmap, thankfully.

DynamoDB is quite inexpensive at low usage levels. The Free Tier gives you: "25 GB of Storage, 25 Units of Read Capacity and 25 Units of Write Capacity – Enough to handle up to 200M requests per month"

DynamoDB's free tier doesn't expire after 12 months. (Source: http://aws.amazon.com/free/)

Both DynamoDB and SimpleDB have free tiers. credstash can happily live in the free tier until you are using it A LOT (more than 25 fetches/second, sustained). Storage in SimpleDB costs about as much per GB as DDB, but DDB gives you more free storage, so DDB is cheaper for any amount of data over 1 GB.

I've gone down that path before of storing encrypted secrets in SimpleDB. Unfortunately, encrypting string values will bloat the length of your strings, bumping against the 1024 value limit of SimpleDB: http://docs.aws.amazon.com/AmazonSimpleDB/latest/DeveloperGu...

Didn't think about that. There are, of course, ugly workarounds, but I just asked about SimpleDB not because it's fun to use, but because of its low cost in this scenario.

I forgot SimpleDB had per-value limits. Good catch

I think DynamoDB has replaced SimpleDB as the default key-value store if you're running within AWS.

For example, even the official Kinesis Client Library will store its state in a DynamoDB table. (link: http://docs.aws.amazon.com/kinesis/latest/dev/kinesis-record...)

Reply on news.ycombinator.com