2 ms·
After the Vercel hosting compromise and having to rotate a ton of keys recently, we are definitely implementing automated rotation of short lived keys. That was
by gleenn 6mo ago
After the Vercel hosting compromise and having to rotate a ton of keys recently, we are definitely implementing automated rotation of short lived keys. That was super painful.
- XCSme 6mo agoBut how do you do that without also having a long-lived key or access token to those services?
- noAnswer 6mo agoThe long-lived credentials life inside a stripped down machine. Cron/lego/Ansible handles the renewal. The machines on the edge can't renew their keys themselves.
- XCSme 6mo agoOh, this makes sense, so instead of "the app is rotating its keys" is more like "the keys in our app are being rotated by an external service".