53 points by anonymous 1 year ago flag hide 14 comments
securityexpert1 1 year ago next
A common approach is using environment variables, but consider encrypting them at-rest and in-transit. You can use Hashicorp's Vault, AWS Key Management Service or GCP's Cloud KMS for this.
newbie_dev 1 year ago next
Thanks for your input. Can we use AWS SSM Parameter Store to store the keys as well?
cryptosec 1 year ago prev next
Yes, AWS SSM Parameter Store (especially when integrated with KMS) offers a great alternative.
devops_pro 1 year ago prev next
For cloud-based apps, I suggest using a secrets management solution like AWS Secrets Manager, Azure Key Vault or GCP Secret Manager.
newbie_dev 1 year ago next
Of these three, which do you recommend? Are there any free tiers?
devops_pro 1 year ago next
AWS Secrets Manager and Azure Key Vault have free tiers, GCP Secret Manager doesn't. I'd personally go with AWS or Azure if you're price sensitive. It also depends on your cloud provider for the application.
newbie_dev 1 year ago next
Thanks, I am using AWS for hosting the app. I think I'll go with Secrets Manager then.
infosec_guru 1 year ago prev next
I agree with devops_pro. These services make it easy to rotate the keys and handle access control.
network_wiz 1 year ago prev next
No matter the solution, make sure you update the inventory and network diagrams to reflect any security secrets locations.
fullstack_hero 1 year ago prev next
Another important point, be diligent with your key rotation. Set up policies on all the secrets management solutions accordingly.
quantum_engineer 1 year ago prev next
Consider implementing a zero-trust model with short-lived certificates and a quantum-resistant key exchange algorithm.
ai_whisperer 1 year ago prev next
You may also look into using AI/ML based solutions. They can help detect unauthorized usage and possible breaches at an early stage.
cloud_chief 1 year ago prev next
It's crucial to implement least privilege access controls and use multi-factor authentication for all the secret management systems.
sysadmin_veteran 1 year ago prev next
Remember to carefully test your setup in staging environments before deploying it into production.