6 ms·
There are a ton of companies that do this as a service: - https://www.doppler.com/ https://www.doppler.com/ (my favorite) - AWS Secrets Manager - Google Clou
by mahmoudimus 4y ago
There are a ton of companies that do this as a service:
- https://www.doppler.com/ https://www.doppler.com/ (my favorite)
- AWS Secrets Manager
- Google Cloud Secret Manager
- Azure Key Vault
- https://AKeyless.io https://AKeyless.io
- https://EnvKey.com https://EnvKey.com
Then, there's a few companies that do OSS solutions:
- Hashicorp Vault (https://vaultproject.io https://vaultproject.io)
- CyberArk Conjur / Secretless (https://github.com/cyberark https://github.com/cyberark)
I'm sure there are lots that I've missed.
- brainbag 4y agoWhat makes Doppler your favorite out of this list?
- freeqaz 4y agoAs a security guy, I'm always worried about secrets living in Env variables because it's an easy place for them to leak. (Many loggers will automatically log env vars, for example.) That's why many services, like Kubernetes, have moved away from this model by either serving the secrets up in a runtime-mounted file (like /var/secrets.yaml) or by requiring you to make an explicit API call (SecretsManager.readSecret("foo")). From a security perspective, those paths require a much more difficult exploit like full Remote Code Execution (RCE) in order to leak values. The downside is that it requires modifying application logic to migrate away from Env vars though. Usually it's pretty easy, but if you have tons of legacy code I'm sure that often presents a challenge.
- digianarchist 4y agoVault supports reading secrets from a file when using Nomad.