Securely store password for Java Keystore

Question

Background

I am implementing set of Micro services using Java spring MVC and hosted in Undertow containers using Gradle. I am using a Java keystore to secure my keys which are using by the service to perform encryption and signing.

When a user spawning a Micro service, user injects the password into Gradle as follows.

gradlew bootRun -Dpassword=thePassword

This is ok for a normal usage because user is the one who enters the password.

Problem

There is a requirement that we need to spin up Micro services based on the demand automatically (for peak hours) and shut down when the load decreases. I can automate this but I need to hard code my password(s) in to my shell script(s) which is/are responsible for spin up services automatically.

Question

How can I secure my password(s) and do this automation ?

Answer 1

This is a recurring problem in app security: even if you store your secrets in a protected datastore, you have to authenticate to that, which means you've got another secret to manage, which puts you back at the original problem. Unfortunately, there's no cut-and-dry canonical solution.

The best you can do is to try to minimize risk by introducing different types of systems that are a bit harder to falsify. Are you using physical servers (presumably with some sort of virtualization layer on top)? You might store the encryption key on a smartcard or similar physical device that's plugged in to the machines, and lock down the software access to it to only the user responsible for scaling the app. Are you using AWS? You can take advantage of Amazon's machine-based roles, and lock down which IAM users are allowed to launch machines with those roles. Maybe you have a manual step when deploying new code that adds a private key and then bakes a virtual machine image, and you heavily restrict which users can access those baked images. None of these solutions are perfect, but they help limit the entry points into the secure data.