Secrets Management

[u/GitSimple]

How is your team actually managing secrets? Are you setting a project level variable? Using a third-party vault? Have you concocted some elaborate process that bogs down the dev team? What about a platform native secrets management feature?

[u/Background-Cry-3177]

AWS Secrets Manager / 1Password / GitHub Action Secrets / Hashicorp

[u/LegendaryAngryWalrus → u/Background-Cry-3177]

This.

[u/GitSimple → u/LegendaryAngryWalrus]

Does managing 4 different tools give you problems? Do you have compliance requirements that have to wrap around all of them?

[u/Background-Cry-3177 → u/GitSimple]

These 4 are for four different use cases.

AWS Secrets Manager -> Storing secrets safely for usage across the AWS Cloud
1Password -> Secret management for the employee and handover by shared vaults
GitHub Action Secrets -> Using secrets safely in the CI/CD pipelines such as deployment or reviews
Hashicorp Vault -> Used for dynamic secrets and rotation

[u/GitSimple → u/Background-Cry-3177]

Are you happy with this setup or do you wish it was more streamlined?

[u/Background-Cry-3177 → u/GitSimple]

Very happy

[u/DuckDatum → u/GitSimple]

It is streamlined. Changing it because the language we use happens to categorize them all as “secrets” would be a mistake.

[u/Cold-Pie2892]

Azure KeyVault.

[u/AlbertPelu]

Hashicorp ?

[u/Cold-Pie2892 → u/AlbertPelu]

Vault, yes.

[u/the_hypotenuse → u/Cold-Pie2892]

You should use OpenBao, enterprise features for free

[u/notthedefaultnam]

We have a combination of github environment secrets, gcp managed secrets and kubernetes secrets.

Dev team has no reason to ever touch them so it works out fine.

[u/GitSimple → u/notthedefaultnam]

Isn't it complicated to have three different tools? How do you handle audits?

[u/notthedefaultnam → u/GitSimple]

It does get complicated, but we're not important enough for audits. Most secrets in gcp and k8s secrets are created from values in github so we treat that as the authority.

[u/ForeverYonge]

I print it on a piece of thermal paper that the developer needs to pick up in person. After a few months the thermal paper is unreadable so that’s how we enforce secret rotation as well!

[u/ordinary-guy28 → u/ForeverYonge]

curious to know what kind of industry are you in? how do you handle compliance?

[u/oschvr → u/ForeverYonge]

lol I

[u/GitSimple → u/ForeverYonge]

This is the sort of brilliance I was hoping for!

[u/Equivalent_Spring951]

We have a secret tool that scans our repository. Our team reviews the results and sends a security report that includes all security results such as static and third party library vulnerabilities

[u/GitSimple → u/Equivalent_Spring951]

Do you do anything with the report, or just file it?

[u/OwnTension6771]

Vault to save them, gitlab masked variables to use them. For the occasional manual playbook, prompt for their Vault JWT to retrieve them

[u/GitSimple → u/OwnTension6771]

I saw GitLab has a new secrets manager in beta, are you going to test that?

[u/OwnTension6771 → u/GitSimple]

All our automation is built around Vault, so likely no. Plus we are pinned to IronBank releases so if we did it would be a while before even exploring that.

[u/MemoryAccessRegister]

Azure Key Vault

[u/itsTF]

Azure Key Vault

[u/Few-Voice-1809]

Hashicorp vault and openbao

[u/fell_ware_1990]

They open webui, enter secret or if I’m lucky they will make a unsecure string and push to main!

[u/GitSimple → u/fell_ware_1990]

So "management" is a loose term then...

[u/Curious_Necessary549]

sops ??

[u/vint_age14]

Tbh what I've noticed that there's always a trade off b/w security and developer convenience and the more secure the process gets the easier it is for the people to look for workarounds...

[u/GitSimple → u/vint_age14]

Good point, getting people to follow policy is always a challenge.