Henry Been - Secure Deployments - Keeping your application secrets private

As Henry presented at the Amsterdam Secure Software Development Meetup on Dec 11th, 2018

Transcript

1. SECURE DEPLOYMENTS KEEPING YOUR SECRETS PRIVATE Henry Been "Locks" (CC BY-NC-ND 2.0) by wolf4max
2. WONDERING WHO IS THAT GUY? HENRY BEEN Independent Devops & Azure Architect E: consultancy@henrybeen.nl T: @henry_been L: linkedin.com/in/henrybeen W: henrybeen.nl
3. So… WHO DOES DEVOPS?
4. THE NEED FOR SECRET MANAGEMENT Develop Build Deploy Operate Dev Ops DevOps
5. Secret management goals No team member needs production access Frequently change secrets Decouple authentication from authorization No secrets in source control
6. HOW NOT TO DO SECRET MANAGEMENT
7. 1. Let operations deploys 2. Enter manually in the portal 3. Encrypted in source control 4. Use once, obscure https endpoint HOW NOT TO..
8. So… HOW THEN?
10. Approach 1 USING RELEASE ORCHESTRATOR VSTS Secrets Azure Web App Code
11. DEMO TIME! USING RELEASE ORCHESTRATOR
12. USING RELEASE ORCHESTRATOR • Secrets are pretty secure • Easy to start with • Fits existing situations • You see and copy secrets • Secrets visible in portal • Duplication of secrets • Cannot roll secrets easily Pros Cons
13. Prerequisite: Have primary & secondary secrets 1. Change the secret in release orchestrator to secondary secret 2. Release 3. Roll primary secret 4. Change the secret in release orchestrator to primary secret 5. Release 6. Roll secondary secret Intermezzo: Roll a secret
14. Approach 2 USING ARM TEMPLATES Azure Web App Key Vault VSTS Code & Infra
15. DEMO TIME! USING ARM TEMPLATES
16. USING ARM TEMPLATES • No manual copying or sharing of secrets • No more manual duplication of Azure keys • Secrets visible in portal • Still cannot roll secrets easily Pros Cons
17. Approach 3 DIRECTLY FROM KEY VAULT VSTS Azure Web App Code & Infra Key Vault
18. HOWTO: Local Development 1. Grant your developer account access to (another) Key Vault • Best alternative • Requires your machine to be in the same AD domain 2. Only use Key Vault in Azure (locally use Web.config) • You have to write code to do this (though pretty straightforward) 3. Manually create a development identity and use that • However… do not check secrets into source control
19. DEMO TIME! DIRECTLY ACCESS KEY VAULT
20. DIRECTLY ACCESS KEY VAULT • No manual copying or sharing of secrets • No more duplication of Azure keys • Secrets no longer visible in portal • Changed secrets are automatically picked up • Only available on Azure Web Apps, Azure Functions and DataFactory V2 Pros Cons
21. Approach 4 DIRECTLY ACCESS SERVICE VSTS Azure Web App Code & Infra AAD Other Service
22. DEMO TIME! DIRECTLY ACCESS SERVICE
23. DIRECTLY ACCESS SERVICE • No more secrets • Only available on Azure Web Apps, Azure Functions and DataFactory V2 • Only on supported services Pros Cons
24. Supported services • Azure Resource Manager • Azure Key Vault • Azure Data Lake • Azure SQL DB • Azure Event Hubs • Azure Service Bus • Azure Storage https://docs.microsoft.com/en-us/azure/active-directory/managed-service-identity/services-support-msi
25. Runtime AppSettings App.config ConfigBuilders Approach 5 CONFIG BUILDERS Requires: • (.NET Framework ≥ 4.7.1 &&.NET Framework 4.7.1 Development Tools) || ASP.NET Core 2.0
26. CONFIG BUILDERS For local development…
27. CONFIG BUILDERS For cloud…
28. Many, many connection strings
29. Premade config builders • EnvironmentConfigBuilder • UserSecretsConfigBuilder • AzureKeyVaultConfigBuilder • KeyPerFileConfigBuilder • SimpleJsonConfigBuilder • Extensible interface to plug in your own! https://docs.microsoft.com/en-us/azure/active-directory/managed-service-identity/services-support-msi
30. Using .NET Core
31. Use your release orchestrator Manual deployment NEVER EVER EVUHRR When you deploy only code Keyvault and ARM templates When you also deploy infra Application identity / KeyVault When available & possible Application identity / Oauth resource When available & possible WHAT TO USE WHEN? Config builders When available & possible
32. One more thing https://azure.microsoft.com/en-us/blog/simplifying-security-for-serverless-and-web-apps-with-azure-functions-and-app-service/
33. One more thing https://azure.microsoft.com/en-us/blog/simplifying-security-for-serverless-and-web-apps-with-azure-functions-and-app-service/ @Microsoft.KeyVault(SecretUri=https://myvault.vault.azure. net/secrets/mysecret/ec96f02080254f109c51a1f14cdb1931)
34. DO TRY THIS AT HOME! HENRY BEEN Independent Devops & Azure Architect E: consultancy@henrybeen.nl T: @henry_been L: linkedin.com/in/henrybeen W: henrybeen.nl