3 ms·
Because the alternative of scattered, DIY secret stores is much worse.
by candiddevmike 2y ago
Because the alternative of scattered, DIY secret stores is much worse.
- g8oz 2y agoOTH they limit the blast radius.
- acdha 2y agoIf your DIY secret store is an exposed network service, maybe. If your secret store is a set of conventions which keeps access confined to the application environment, no. Things like Ansible Vault, AWS/Azure/GCP/etc. secrets using role-based, etc. have the nice property that they are isolated from unrelated apps so an attacker can’t breach one thing and move laterally across all of your applications. You have to protect that core infrastructure anyway so there’s an argument for not doing so more times than necessary.