3 ms·
For a long time and probably still today, Google AppEngine kinda encouraged storing secrets in the YAML, which is easy to accidentally git-commit. There's no ea
by frollogaston 1y ago
For a long time and probably still today, Google AppEngine kinda encouraged storing secrets in the YAML, which is easy to accidentally git-commit. There's no easy way to pass secrets to your services otherwise, unlike Heroku etc where it's always been a single command to put them into envvars on the jobs.
Last time I tried, the default suggestion was Cloud KMS (yeah), now there's some new secret manager that also looks annoying: https://stackoverflow.com/questions/58371905/how-to-handle-secrets-in-google-app-engine https://stackoverflow.com/questions/58371905/how-to-handle-s...
- null_deref 1y agoAnd can we talk about the predatory pricing model? In AWS one secret service prices a secret for 0.4 dollars a month. I was appalled when I first saw it, are you going to charge me 5$ a year for storing my 12 bytes?
- bdcravens 1y agoIf all you're doing is storing, and not using advanced features like auto rotation, Parameter Store is free for most use cases.
- null_deref 1y agoOk I may have misread the pricing model, I’ll look into it, thanks!
- bdcravens 1y agoTo be clear, Parameter Store is a separate product from Secrets Manager, but is essentially the same thing without features like the UI, key rotation, etc. Functionally though, they're the same (for example, passing secrets into an ECS container is just a matter of passing the ARN)
- null_deref 1y agoThank you! Just implemented this in my lambda, still a bit frustrated there is no easy way to push env vars from the deploying machine