[JIRA] (JENKINS-60132) Add support for AWS parameter store as a backend for storing credentials

[chris+jenk...@chriskilding.com (JIRA)]

Title: Message Title

Chris Kilding updated an issue   Jenkins / JENKINS-60132 Add support for AWS parameter store as a backend for storing credentials Change By: Chris Kilding *Feature* Allow Jenkins to look up credentials in AWS Parameter Store. (They will be stored as Secure String parameters [https://docs.aws.amazon.com/systems-manager/latest/userguide/sysman-paramstore-securestring.html]). *Rationale* - Storing credentials in Parameter Store can be cheaper than storing them  in Secrets Manager. - TODO anything else? *Questions* - Does this belong in its own project/plugin or is there opportunity for code reuse as part of aws-secrets-manager-credentials-provider-plugin? - Does   *Comparison of services* $ = chargeable ||Feature||Secrets Manager||Standard Parameter Store offer acceptable API rate limits and QoS for Jenkins to rely on? ||Advanced Parameter|| |Size|10.24kb|4kb|8kb| |Storage cost / month|$|Free|$| |IAM per - Could we store all major credential types secret policy|Yes| No|Yes| |Max API calls / sec ( especially binary ones like the PKCS#12 certificate retrieval ) in Parameter Store? |1,500 ($)|40 (free) 1,000 ($)|40 (free) 1,000 ($)| |Max num secrets|40,000|10,000|100,000| |String secrets|Yes|Yes|Yes| |Binary secrets|Yes|No|No| *Constraints* - Jenkins should be able to source credentials from both Secrets Manager and Parameter Store. (Using one should not rule out using the other.) - If Jenkins encounters an error looking up secrets in one of the services, this should not impede lookups in the other. (An exception from a Secrets Manager API call should not break secret resolution in Parameter Store if PS is still functioning.) - Tag naming conventions should be shared in both PS and SM. (Eg a username tag should be called {{jenkins:credentials:username}} in PS, just like it is in SM today.) Add Comment   This message was sent by Atlassian Jira (v7.13.6#713006-sha1:cc4451f) -- You received this message because you are subscribed to the Google Groups "Jenkins Issues" group. To unsubscribe from this group and stop receiving emails from it, send an email to jenkinsci-issues+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/jenkinsci-issues/JIRA.202985.1573481513000.6373.1576152780318%40Atlassian.JIRA.