aws-samples / aws-samples/aws-secrets-manager-ssh-key-rotation

Ineffective security measure in copy_file.py

Open
#2 0 comments 1 reaction 0 assignees View on GitHub
Dominant language
Python
Stars
64
Forks
24
PR merge metrics
No merged PRs in 30d

Description

This line of code is intended to purge the secret from memory:

https://github.com/aws-samples/aws-secrets-manager-ssh-key-rotation/blob/163b90fd217a7ce9285d700bca8afe87a0f181b3/scripts/copy_file.py#L65

Unfortunately, it does not: python strings are immutable, and reassignment of a string variable in python allocates a new buffer, leaving the old buffer in memory as garbage. Thus the best practices being espoused here are not actually being adhered to.

I verified this using a similar approach to [this nice blog post](https://www.sjoerdlangkemper.nl/2016/06/09/clearing-memory-in-python/):

```
$ echo 'import os; x="verysecret"; x="###############"; del x; os.abort()' > test.py
$ ulimit -c unlimited
$ python3 test.py
Aborted (core dumped)
$ grep verysecret core
Binary file core matches
```

Thus this string would remain in RAM until the same address happens to be used again later.

The [AWS blog post](https://aws.amazon.com/blogs/security/how-to-use-aws-secrets-manager-securely-store-rotate-ssh-key-pairs/) accompanying this repository wrote:

> details about keeping secret data in volatile memory will follow later in this post.

...but no such details seemed to be forthcoming.

Contributor guide

Open the contributing guide

Research direction

Start with scripts/copy_file.py at the linked line 65 and reproduce the memory-retention behavior using the issue's Python example. Review the accompanying AWS blog post and determine a supported way to handle the secret without relying on immutable-string reassignment; done means the ineffective security measure is removed or replaced and the behavior is verified.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.