3 ms·
We have recently started removing credentials in env vars and started using google secret manager (previously berglas) and its been amazing so far. AWS and azur
by hankchinaski 6y ago
We have recently started removing credentials in env vars and started using google secret manager (previously berglas) and its been amazing so far. AWS and azure should have the same. More challenging when you don’t have all the infrastructure and services in place (ie. when working on plain VPS or other systems without those tools)
- seer 6y agoHm not sure I understand how google secret manager relates to berglas to be honest, thought those two were separate apis... As for berglas itself, we also use it and have been very happy with it. Since you put just the names of your secrets into the ENV files, not the secrets themselves, they can be easily stored in version control, passed around in chat and you can just do whatever you want with them. Instead of: ENV_PASS=my-secret-pass You do: ENV_PASS=berglas://bucket/secret-id And it will be decrypted at the last possible moment - e.g. when the system starts. Or even later if you need to, if you use the apis provided. Funny enough we had implemented the almost the same approach with AWS SSM apis ourselves (https://github.com/ovotech/ssm-env-secrets https://github.com/ovotech/ssm-env-secrets). But I think it should be possible to use berglas in AWS directly without issue.
- giberti 6y agoAmazon has a similar offering called Secrets Manager which can be used for sensitive secrets as well as configuration values. https://aws.amazon.com/secrets-manager/ https://aws.amazon.com/secrets-manager/