How do I securely store credentials and key files on my mac?

Question

There must be a handy way to securely store, say, GCP key.json somewhere on my machine and access it whenever I'm deploying stuff. Backup to cloud is a must. The Apple's Keychain access seems troublesome. Is there a better solution?

Answer 1

I know you quickly dismissed Apples own Keychain but I'd like to make a case for it and help guide you in the right direction of how you can use it via terminal.

• It’s protected by 256-bit AES encryption.
• It's backed up on cloud servers.
• You can use it to store secure notes.

Locally the keychains are stored in ~/Library/Keychains/ and /Library/Keychains and Apple has a command line utility called security (/usr/bin/security) that can be used to administer. see man security for help on this command. It's fairly robust and documentation out side the man page is sparse. I was able to quickly create a keychain although I didn't spend too much time on it.

If security is too much of a learning curve, I'd recommend a python module called Keyring It has a command line utility that while is not as robust but very simple to set and get data to the keychain. I sometimes use it to store credentials for scripts instead of using .env.

Answer 2

It very much depends on who else has access to your machine, but putting a file on your filesystem and restricting access to that folder with chmod 400 is a pretty good first step.

You can use secret managers like lastpass and keypass as well