SimpleDB is deprecated, more expensive than DDB, and kind of weird to use. Backing your keystore with a deprecated service just sounds like a road to many sleepless nights ;)
The utility does depend on three external services: DynamoDB, KMS, and IAM (for permissioning). This might sound like a lot, but the target usecase for something like this is a fleet running in the cloud. If you're already running in EC2, then using IAM roles to distribute AWS creds is a no-brainer and very simple. KMS and DDB are also not arduous things to depend on if you're already in the cloud.
For credstash, you need to set up your KMS key (and set whatever policies around it make sense for you). Once you do that, there's nothing to manage. Sure, you depend on DDB, but credstash creates the table for you, and unless you need to dial up more throughput (which is a mouse-click operation), you never have to touch it.
The page is still up, and AWS is obviously still running the service (and will as long as customers keep using it), but it's not linked from anywhere. Here's a list of all the AWS services (https://aws.amazon.com/products/) and it's not listed. If you look at the developer guide, it hasn't been updated in three years.
It may not be officially deprecated, but a service tat hasn't been touched in three years, which AWS will only tell you about if asked very specifically, makes me not want to use it as a foundation for any new services.
I am sorry, but how can DynamoDB be cheaper when I have to pay to provision capacity and SimpleDB is practically free for low-volume stuff like this? S3 is probably an even better option, which seem to be on the roadmap, thankfully.
DynamoDB is quite inexpensive at low usage levels. The Free Tier gives you:
"25 GB of Storage, 25 Units of Read Capacity and 25 Units of Write Capacity – Enough to handle up to 200M requests per month"
Both DynamoDB and SimpleDB have free tiers. credstash can happily live in the free tier until you are using it A LOT (more than 25 fetches/second, sustained). Storage in SimpleDB costs about as much per GB as DDB, but DDB gives you more free storage, so DDB is cheaper for any amount of data over 1 GB.
I've gone down that path before of storing encrypted secrets in SimpleDB. Unfortunately, encrypting string values will bloat the length of your strings, bumping against the 1024 value limit of SimpleDB: http://docs.aws.amazon.com/AmazonSimpleDB/latest/DeveloperGu...
Didn't think about that. There are, of course, ugly workarounds, but I just asked about SimpleDB not because it's fun to use, but because of its low cost in this scenario.
14 comments
[ 3.1 ms ] story [ 42.4 ms ] threadThe utility does depend on three external services: DynamoDB, KMS, and IAM (for permissioning). This might sound like a lot, but the target usecase for something like this is a fleet running in the cloud. If you're already running in EC2, then using IAM roles to distribute AWS creds is a no-brainer and very simple. KMS and DDB are also not arduous things to depend on if you're already in the cloud.
For credstash, you need to set up your KMS key (and set whatever policies around it make sense for you). Once you do that, there's nothing to manage. Sure, you depend on DDB, but credstash creates the table for you, and unless you need to dial up more throughput (which is a mouse-click operation), you never have to touch it.
It actually doesn't appear to be officially deprecated at all, although perhaps it is considered feature complete:
http://aws.amazon.com/simpledb/
However, Amazon seems to ignore questions as to its status which tends to make me wary as well.
It may not be officially deprecated, but a service tat hasn't been touched in three years, which AWS will only tell you about if asked very specifically, makes me not want to use it as a foundation for any new services.
According to the release notes: http://aws.amazon.com/releasenotes/Amazon-SimpleDB the last update to the service was 2011
DynamoDB's free tier doesn't expire after 12 months. (Source: http://aws.amazon.com/free/)
For example, even the official Kinesis Client Library will store its state in a DynamoDB table. (link: http://docs.aws.amazon.com/kinesis/latest/dev/kinesis-record...)