# Using credentials manager to store Logstash's keystore password

**URL:** <https://discuss.elastic.co/t/using-credentials-manager-to-store-logstashs-keystore-password/243131>\
**Category:** Logstash\
**Tags:** elastic-stack-security\
**Created:** [July 29, 2020, 9:43pm UTC](https://discuss.elastic.co/t/using-credentials-manager-to-store-logstashs-keystore-password/243131 "2020-07-29T21:43:49Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![GusAntoniassi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gusantoniassi/32/46074_2.png) [@GusAntoniassi](https://discuss.elastic.co/u/GusAntoniassi)\
**Post date:** [July 29, 2020, 9:43pm UTC](https://discuss.elastic.co/t/using-credentials-manager-to-store-logstashs-keystore-password/243131/1 "2020-07-29T21:43:49Z")

</div>

Hello!

I am currently using Logstash 7.8.0, running as a service and installed via package manager (yum) on an Amazon Linux OS.

I am the Logstash Keystore to store some sensitive credentials used by my pipelines. I managed to make it work by setting the keystore password as the `LOGSTASH_KEYSTORE_PASS` variable in the `/etc/default/logstash` file, but it had to be stored in plain text.

I would like to know if I can secure this setup better, like using an external credential store such as Amazon SSM Parameter Store. I have tried passing a subshell command in the `/etc/default/logstash` file, such as:

```
LOGSTASH_KEYSTORE_PASS=$(aws ssm get-parameter --name /logstash/keystore-password --region us-east-1 --with-decryption --query 'Parameter.Value' --output text)

```

But it did not work as intended, as the logstash service failed to start with errors such as:

```
Jul 29 21:38:40 ip-xx-xx-xx-xx.ec2.internal logstash[18288]: [2020-07-29T21:38:40,001][ERROR][logstash.agent] An exception happened when converging configuration {:exception=>LogStash::Error, :message=>"Don't know how to handle `Java::OrgLogstashSecretStore::SecretStoreException::AccessException` for `PipelineAction::Create<main>`", :backtrace=>["org/logstash/execution/ConvergeResultExt.java:129:in `create'", "org/logstash/execution/ConvergeResultExt.java:57:in `add'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:355:in `block in converge_state'"]}

```

I would like to know if it is possible to use an external credentials manager with Logstash, or somehow not having the keystore password stored in plain text on the `/etc/default/logstash` file.

Thanks in advance for your attention

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 26, 2020, 9:43pm UTC](https://discuss.elastic.co/t/using-credentials-manager-to-store-logstashs-keystore-password/243131/2 "2020-08-26T21:43:54Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.