3 ms·
Excuse me while I pick myself up off the floor when I read "leaks environment variables"... What?? That is incredibly scary for use, as we just went through an
by cyberferret 10y ago
Excuse me while I pick myself up off the floor when I read "leaks environment variables"... What?? That is incredibly scary for use, as we just went through an audit process of our code on about 6 different web apps to ensure that all secrets were placed in environment variables on our Elastic Beanstalk configs and not in the main codebase... If this now results in LESS security (all our code is in private Git repositories) than before, then we have essentially taken a step backwards!
- dorfsmay 10y agoGithub private repos have been made public by mistake before. Got repos are cloned on dev laptops, do you enforce laptop encryption? The right thing to do is using some form of a vault.
- cyberferret 10y agoWe use BitBucket here, rather than Github - similar risks, I know, but we have predetermined repositories which are all set as private. 3 dev machines which are kept on premises at all times. Still not optimal as far as security goes, but it seems that he have roughly the same exposure if AWS leaks our keys and passwords to other third party trackers...
- Ixiaus 10y agoUse kms and dynamodb with key enveloping, or this tool: https://github.com/fugue/credstash https://github.com/fugue/credstash Don't initialize into env vars and don't store in repos, even private ones.
- cyberferret 10y agoThanks - sounds like a good solution. I will look into this in detail over the weekend.
- fletchowns 10y agoBe careful when modifying user access to a private BitBucket repository. Their autosuggest for the username input field will show all bitbucket users. Makes it incredibly easy to accidentally grant somebody outside of your organization access to a repository.
- iampims 10y agoI can attest to that. I have the username "tim" on bitbucket and get added to private repos all the time by mistake.
- fletchowns 10y agoOn top of that, there's no audit history of who has had access to a repository. Absolutely ridiculous.
- fapjacks 10y agoThis is really the best suggestion. I've been using Hashicorp's Vault for storing sensitive configuration information and can't recommend it enough. The rest of Hashicorp's stack of software for Docker is also extremely nice.
- StreamBright 10y agoThe best audit proof solution to this is using an encrypted database where you can securely push down secrets that you share only with certain users on particular nodes. This is what we used earlier with a bigger company to pass all audits. The ability of reading secrets are tied to a unix user and a fleet (identified by IP ranges for example). The secrets are encrypted and the nodes have the key do decrypt it. Keys are distributed securely at provisioning time. I am not aware any opensource platform that would do this to you out of the box though.