We need to automate password rotation for service accounts in AWS and on-prem databases. The requirement is a scheduled, programmatic rotation integrated with our existing IaC and CI/CD.
CyberArk's Privileged Access Manager and Okta's Advanced Server Access are both in evaluation. Initial findings:
* CyberArk: Rotation logic is handled within the PAM vault. You define connectors and schedules in the CyberArk console. API is RESTful but the rotation workflow is largely a black box managed by CyberArk.
* Okta ASA: Leverages short-lived certificates for access. For true password rotation, you typically pair it with a secrets manager (like AWS Secrets Manager) and use Okta's integration to trigger a Lambda. The rotation logic is your own code.
Example of a simple rotation Lambda that Okta ASA could trigger via EventBridge:
```python
import boto3
import psycopg2
from aws_secretsmanager_caching import SecretCache
client = boto3.client('secretsmanager')
cache = SecretCache(client)
def rotate_password(secret_id):
# Get current secret
current = cache.get_secret_string(secret_id)
# Generate new credential
new_password = generate_secure_password()
# Update in target system (e.g., PostgreSQL)
update_database_credential(current['username'], new_password)
# Update secret in AWS Secrets Manager
client.put_secret_value(SecretId=secret_id, SecretString={'username': current['username'], 'password': new_password})
```
Key difference: CyberArk provides the rotation engine; Okta ASA often acts as the trigger and gatekeeper, delegating the rotation logic to your code or another service.
Which approach yields better auditability and less operational overhead in a hybrid, multi-cloud environment? Concrete experience with failure modes in automated rotations?