0

When developing web applications that require access to a database, or any other service, they will somehow have to posess a secret like a password or connection string. This secret has to be configured in database and web application. If it's only one secret, it can probably be done manually in configuration files after deployment, but adding more secrets to the infrastructure, at some point automation will be required.

Additionaly, in the age of DevOps, automatic building, continuous integration and continuous deployment you sometimes have to be able to deploy your application regularly in test, stage and production environments. Usually multiple developers will require the ability to deploy, at least on test and staging environments.

I can think of numerous ways of how to manage secrets and read quite some documentation and blog posts about this, but I'd like to gather more insight and maybe improve my process.

I'd therefore like to know, what you think of the following approaches:

  1. Deploy secrets only manually after deployment. Store them in encrypted files outside of version control.
  2. Deploy secrets automatically after deployment. Store them in encrypted files outside of version control and only on configuration management server.
  3. Deploy secrets automatically after deployment. Store them in encrypted files in a version control for configuration management (i.e. ansible vault, chef secret data bag, puppet secrets).

I am currently in favor of option 3, as it reconciles security with usability, but I've also just read this question and some of it's answers, which generally advise to refrain from storing (even encrypted) secrets in version control.

Maybe I even have better options?

  • 1
    Great question - I’ll write a response to this in a bit. First, to clarify, how are you deploying without the secrets? I’m not sure I understand your pipeline completely. – securityOrange Feb 23 at 16:46
  • @securityOrange: I'm not quite sure, if I got your question right. With "deploying without secrets" I meant a clone of the git repo without the configuration files containing the sensitive information. The secrets would then be added in a second step (either manually or automatically). – Euphrasius von der Hummelwiese Feb 24 at 10:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.