Suppose I'm building a service to store all the secure or sensitive information that my other applications use. Think passwords, or private SSH keys. Under the old programming paradigm of 'do one thing really, really well', I want to make this service as ironclad as possible. I'm taking the following precautions:
- All data is encrypted in the database (duh)
- Stored data is randomly assigned to one of multiple databases (even if one database were compromised, not all the data is on that one)
- Access to data is controlled by specific token permissions - token A does not have permission to access token B's data and vice versa, and token C is the only one with permission to write data, A and B can only read it (for example)
- The actual service runs on AWS, so we have their 'physical' security precautions
- SSH access to production is permanently disabled - when a new deployment needs to go up, a script runs on AWS that spins up a brand new server. The server has a startup script that pulls the most recent build from Bitbucket and performs the necessary setup steps
- There is an actual dashboard to manage tokens etc. - this dashboard is protected by two-factor authentication (I get a code on my phone that I need to enter in when I want to login, in addition to username/password)
This seems to me to be a fairly secure environment, but I can identify a couple vulnerabilities:
- My AWS account: If my AWS account were compromised, an attacker could easily edit the server startup script to do something malicious, or open up SSH access to the production server.
- My Bitbucket account: Likewise, if my Bitbucket account were compromised, an attacker could include malicious code in my project build, which would then be pulled by the server next time it deployed.
These are the obvious vulnerabilities - nonetheless, I'm not sure how to protect that avenue of attack. I'm also worried about not knowing what I don't know - are there any attack vectors I haven't considered, or flaws in my planned setup?