Storing aws sts credentials efficiently in database or yaml files

CloudQuery Plugins
1

Hi,

In my web application, I create AWS credentials for users using AWS STS (Security Token Service) with specific roles (role ARN) and an external identity (external ID). Subsequently, I need to store these credentials in my database to enable users to access various services in their AWS accounts.

What is the most effective way to accomplish this process? Should I store these credentials as variables in YAML files, or is there a more efficient method?

2

Usually the best way is to store those in Secret Manager (there are plenty of those vaults, AWS Secrets Manager, 1Password) and then expose them as environment variables. The AWS plugin can then use those environment variables which are exposed.

3

Due to the need for multiple processes to occur simultaneously, is it possible to provide the environment variable to PluGin in a different way instead of using ENV variables?

4

Which plugin are you referring to?