1

I am thinking about using a vps on a hosting provider that does not offer cloud services like kms, or vpc on for example AWS for a webapp. The webapp will need to encrypt some sensitive data in the database.

When comparing the vps and vpc, vpc does have key management services, such as AWS KMS, which safely stores and rotates the keys.

For the vps, the only thing I can think of is to save the keys in a dotenv file. This means that they are not rotated and will be found in plain text if the vps gets hacked.

Have I understand above correctly and is using a vps then considered insecure comparing to a vpc with key service, or am I missing something?

Improve this question
5
  • Why can't you use a KMS with a non-cloud-resource?
    – vidarlo
    Dec 29, 2022 at 22:13
  • Is riding a bus insecure because you wear no seatbelt compared to driving your own car? You would not know where to start answering this convoluted question and unfortunately that's how yours sounds. If your issue is not to persist keys on disk load the keys in memory when loading the docker instance, or even manually on startup. Do not store in dotenv.
    – zyked
    Dec 29, 2022 at 22:18
  • Sorry, I should have clarified that I meant a vps that is not located at any cloud provider like aws, but from another hosting company that do not offer any cloud services like kms. So if i rephase the question it would be if it is then considered insecure to handle keys on a vps where there is no key management services that you can use. Because I guess that then you can only use dotenv?
    – Hejhejhej123
    Dec 29, 2022 at 23:54
  • @Hejhejhej123: don't hide the explanation on what you really intended to ask in comments. Please edit your question and also the title to be more clear on what you mean.
    – Steffen Ullrich
    Dec 30, 2022 at 8:07
  • I have now edited the question
    – Hejhejhej123
    Dec 30, 2022 at 13:22

1 Answer 1

Reset to default
1

For the vps, the only thing I can think of is to save the keys in a dotenv file. This means that they are not rotated and will be found in plain text if the vps gets hacked.

Yes. But a KMS is not a panacea. You somehow have to authorize access to the KMS, and an attacker may gain access to the credentials required for the KMS as well. What KMS however provide is a mechanism for rotation and invalidation of credentials. If some attacker gets to execute code inside the container you're running stuff in, they can probably access your KMS.

Have I understand above correctly and is using a vps then considered insecure comparing to a vpc with key service, or am I missing something?

Writing my shopping list in cleartext on a piece of paper is probably less secure than keeping it in encrypted form on my phone. However, it's secure enough for the shopping list.

Insecure and secure is not absolutes. Instead, you should decide what level of security you need. This may range from not having the asset available via the Internet at all, to deciding that it's OK for the credentials to be stored in plain text.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .