3 ms·

100% this. 1. Keep secrets in a dedicated secrets store. 2. Read directly from the secrets store in application code. There is no environment, there are no en

• tptacek 1mo ago
  It's pretty normal to keep secrets in a dedicated secret store, and then have the service launcher inject them from the secret store into the environment.
  • nightbrawler 1mo ago
    normal indeed but not what i'd consider a best practice anymore. we've moved away from any secrets in the env after the typical secrets leak when secrets popped up in some debug logging that hit datadog. we now have a secret cache layer api and the app loads secrets securely at time of use from that api. there's also no secret-0 problem because we use IAM auth when calling the cache. edit: for those wondering, api response time is sub 1ms (rust!)
    • e12e 1mo ago
      Just to clarify - for every seperate read, update or write to your database - you setup and teardown a new connection?
    • jiggunjer 1mo ago
      Your iam token is just a secret by another name. Sure it's more automated but theres no avoiding secret0.
• tflinton 1mo ago
  Well you’ll need to know the path in the secret store, so store the path in the environment.