6 ms·
Complexity, the enemy of security. Why is using GitHub secrets insecure exactly?
by nodesocket 5y ago
Complexity, the enemy of security. Why is using GitHub secrets insecure exactly?
- cnuss 5y agoTotally agree re: complexity. My goal is that a few config steps in a GitHub repository and AWS makes a GitHub action able to do a wide variety of things (such as accessing multiple accounts) with very little upstart work. Storing Secrets in GitHub isn't technically insecure, and it's awesome it's provided as a free feature, but it's tedious and fragile. Someone (or something has to do various clicks and copy/pastes or API calls) to upload an access key into GitHub Secrets. It gets even worse if you have multiple accounts and then your Action Workflow file gets really gnarly if you simply pull credentials from ${{ secrets.* }}. Also, if you need to rotate your AWS access tokens, you open up a whole new can of worms, so why not remove credentials all together! Thanks for the question nodesocket, let me know if you have more questions or comments!
- hacker_newz 5y agoWhy does a third party need access to your AWS credentials?
- VectorLock 5y agoTo do stuff in your AWS account.
- nodesocket 5y agoOne of many reasons is pushing containers from GitHub Actions automation to AWS ECR (registry).
- hatware 5y agoIt becomes an anti-pattern when there are more SAML-like, short-lived access approaches available. Do you rotate your keys in secrets regularly?
- cnuss 5y agohey hatware! is that a question/comment for me?
- paranoidrobot 5y agoHaving IAM keys in your secrets isn't insecure. However you now have long-lived keys. They tend to get used across multiple projects, and despite the best practice being to rotate keys frequently, it's rarely done. You also have no idea who has them, and without the use of, say, Cloudtrail, you don't know if anyone is using them (even Cloudtrail might not pick up on everything) The approach here is to get short-lived keys, when they are needed.