Hacker News new | ask | show | jobs
by kondro 3005 days ago
At $0.40 per secret per month and $0.05 per 10,000 requests this is much more expensive than the practically free SSM Parameter Store product, even if you factor in the auto-rotating bits.
4 comments

It'd be cheaper than running Vault with a backing Consul cluster which also provides rotation and other features.

There is a point where Vault is more cost effective, but I believe it'd require a ton of requests and secrets to justify min 6 machines of at least t2.micro that also need to managed and secured.

Depends on how many secrets you're storing.

You can also back Vault with something other than Consul. You can back it with DynamoDB, which would be much cheaper than managing your own Consul cluster. You can even back it with S3, which would be dirt cheap (cost of the vault instance + a few cents for storage).

I wasn't aware you could use Dynamo or S3, that's pretty interesting
It's definitely not cheaper than KMS and DynamoDB via Credstash, though.
What if you're already running a nomad/consul cluster? Is vault a particularly hard thing to implement/scale at that point?
Yea it that case then it's not that hard or extra cost. But I imagine most people aren't already running Nomad or Consul and can benefit from this. Lambdas, Wordpress, etc. can now get rotating secrets which is pretty nice possibility now with a lot less operational overhead.
...and that's without a FIPS 140-2 Level 3 backend for a HSM as well, right? (Secrets Manger has that I assume).

With Vault 1) you have to get Hashi Enterprise 2) Pay for a very pricey HSM.

No, I believe they just use KMS or GCM either which is backed by an HSM and it's recommended in their documentation.
Agree the pricing is way off, but at least you can use an object/table inside a secret to serve as a group of secrets. eg, not just key:"value", but key:{key:"value", key:"value", ...}
Nothing stops you from storing JSON in ParameterStore.
Yeah, I'm surprised they charge per secret. I guess it's a blip when you have big aws spend
Yeah, I don't think too many people have tens of thousands of secrets, generally. The addition of key rotation is a great benefit.
per 10,000 requests