4 ms·

> Production keys in source control IaC, right? If you don't put keys into the Code you can't have Infrastructure as Code. Without keys the code only partially

> Production keys in source control IaC, right? If you don't put keys into the Code you can't have Infrastructure as Code. Without keys the code only partially defines your infrastructure.

JauntyHatAngle 4y ago
Huh? No, you use an external secrets manager or leave it to run time environment vars, or leave it to your cd servers to access/supply those details. Assuming you have been given the right tooling, there is no reason for it to be in source code.
- danenania 4y ago
  If anyone out there is using environment variables currently, and is interested a quick path to plugging the leaks in their secrets management, check out EnvKey[1] (disclaimer: I'm the founder). Because EnvKey integrates tightly with environment variables, no app code changes are needed to switch, so it only takes a minute or two to import/integrate a typical app. EnvKey is designed to help avoid incidents exactly like the one that just hit Toyota, while staying out of your way and even making your life significantly easier as a developer by simplifying many aspects of config management. Give it a look if you know you have some room for improvement in this area and are looking for an easy, secure, open source, end-to-end encrypted solution :) 1 - https://envkey.com https://envkey.com
moooo99 4y ago
Even with IaC you should store secrets only in your environment variables for the CI servers
coenhyde 4y ago
You can put your keys in source control if you are encrypting them with another key which is not in source control. Otherwise you're doing it wrong.
- Too 4y ago
  This is exactly how Ansible-vault works. It's many times better than committing them plain, but I'd still vote for some external service providing the secrets runtime only.
nicholasjarnold 4y ago
Well, I guess in the purest possible sense you're correct. However, I'm currently working with a group using Terraform on GCP (GKE), and it's popular with them to use Secret Manager to manually create a secret in there (when it cannot be auto-gen'd with the IaC, a fairly small subset of things) and then reference that secret from the infra-defining code. I think of it as being akin to "this service requires a correctly configured FOO_BLAH variable in it's environment". I don't really see it as any failure of achieving some IaC goal, but defining infrastructure code isn't my primary function, so take this with a grain of salt.

> Production keys in source control IaC, right? If you don't put keys into the Code you can't have Infrastructure as Code. Without keys the code only partially defines your infrastructure.

JauntyHatAngle 4y ago

Huh? No, you use an external secrets manager or leave it to run time environment vars, or leave it to your cd servers to access/supply those details. Assuming you have been given the right tooling, there is no reason for it to be in source code.

danenania 4y ago
If anyone out there is using environment variables currently, and is interested a quick path to plugging the leaks in their secrets management, check out EnvKey[1] (disclaimer: I'm the founder). Because EnvKey integrates tightly with environment variables, no app code changes are needed to switch, so it only takes a minute or two to import/integrate a typical app. EnvKey is designed to help avoid incidents exactly like the one that just hit Toyota, while staying out of your way and even making your life significantly easier as a developer by simplifying many aspects of config management. Give it a look if you know you have some room for improvement in this area and are looking for an easy, secure, open source, end-to-end encrypted solution :) 1 - https://envkey.com https://envkey.com

moooo99 4y ago

Even with IaC you should store secrets only in your environment variables for the CI servers

coenhyde 4y ago

You can put your keys in source control if you are encrypting them with another key which is not in source control. Otherwise you're doing it wrong.

Too 4y ago
This is exactly how Ansible-vault works. It's many times better than committing them plain, but I'd still vote for some external service providing the secrets runtime only.

nicholasjarnold 4y ago

Well, I guess in the purest possible sense you're correct. However, I'm currently working with a group using Terraform on GCP (GKE), and it's popular with them to use Secret Manager to manually create a secret in there (when it cannot be auto-gen'd with the IaC, a fairly small subset of things) and then reference that secret from the infra-defining code. I think of it as being akin to "this service requires a correctly configured FOO_BLAH variable in it's environment". I don't really see it as any failure of achieving some IaC goal, but defining infrastructure code isn't my primary function, so take this with a grain of salt.