Making sense of secrets management on Amazon EKS for regulated institutions

The article discusses three options for managing secrets in Amazon EKS: External Secrets Operator (ESO), Sealed Secrets, and AWS Secrets and Configuration Provider (ASCP). It provides a comprehensive overview of their architectures, workflows, encryption mechanisms, key management practices, and considerations for meeting regulatory compliance requirements, particularly for financial services institutions (FSI).

Specifically, the article covers:

• Shared responsibility model for security in Amazon EKS
• Architecture and workflow of ESO, Sealed Secrets, and ASCP
• Comparing the objectives of these solutions for regulated institutions
• Installation and deployment considerations
• Encryption and key management approaches
• Additional considerations like centralized management, compliance, high availability, and developer experience
• Threat model and potential mitigations
• Shortcomings and limitations of each solution
• Conclusion on choosing the appropriate solution based on specific requirements and constraints