2 ms·
External "Secrets management services" are among the most attractive hacking targets. It is beyond me why you would have full trust in those.
by splintfrog89 2y ago
External "Secrets management services" are among the most attractive hacking targets. It is beyond me why you would have full trust in those.
- candiddevmike 2y agoBecause the alternative of scattered, DIY secret stores is much worse.
- g8oz 2y agoOTH they limit the blast radius.
- acdha 2y agoIf your DIY secret store is an exposed network service, maybe. If your secret store is a set of conventions which keeps access confined to the application environment, no. Things like Ansible Vault, AWS/Azure/GCP/etc. secrets using role-based, etc. have the nice property that they are isolated from unrelated apps so an attacker can’t breach one thing and move laterally across all of your applications. You have to protect that core infrastructure anyway so there’s an argument for not doing so more times than necessary.
- nemo 2y agoSecrets in env variables are a highly attractive hacking target, they leak easily and can spill the keys to the kingdom.