When developing web applications that require access to a database, or any other service, they will somehow have to posess a secret like a password or connection string. This secret has to be configured in database and web application. If it's only one secret, it can probably be done manually in configuration files after deployment, but adding more secrets to the infrastructure, at some point automation will be required.
Additionaly, in the age of DevOps, automatic building, continuous integration and continuous deployment you sometimes have to be able to deploy your application regularly in test, stage and production environments. Usually multiple developers will require the ability to deploy, at least on test and staging environments.
I can think of numerous ways of how to manage secrets and read quite some documentation and blog posts about this, but I'd like to gather more insight and maybe improve my process.
I'd therefore like to know, what you think of the following approaches:
- Deploy secrets only manually after deployment. Store them in encrypted files outside of version control.
- Deploy secrets automatically after deployment. Store them in encrypted files outside of version control and only on configuration management server.
- Deploy secrets automatically after deployment. Store them in encrypted files in a version control for configuration management (i.e. ansible vault, chef secret data bag, puppet secrets).
I am currently in favor of option 3, as it reconciles security with usability, but I've also just read this question and some of it's answers, which generally advise to refrain from storing (even encrypted) secrets in version control.
Maybe I even have better options?