On: Confidant: an open-source secret management service

[AndrewWright]

Another alternative developed for AWS deployments, written in Python and uses KMS: Credstash https://github.com/fugue/credstash

[ryan_lane → AndrewWright]

The only downside of credstash is that it doesn't have the ability to restrict sets of credentials to different IAM roles. The access is all-or-nothing, per dynamo table.

Otherwise the general design of credstash is very similar to Confidant.

[vogan_mother → ryan_lane]

It is possible to use fine grained access control with dynamodb in order to restrict access within a ddb table