A Developer's Guide to Secrets Management

How do you as a developer use a secrets manager to protect application API tokens, keys, passwords, certificates, and more? In this session, I'll walk through some patterns of storing and using secrets that never change to secrets that change all the time. By learning how to use a secrets manager as a developer, you can keep your secrets a secret and limit the blast radius for a potential attack. You'll get hands on with HashiCorp Vault and .NET Core and figure out the best way to inject your secrets into your application.

Transcript

1. Copyright © 2020 HashiCorp
   A Developer’s Guide
   to Secrets
   Management
   WWCode Connect Forward
   December 2020
   

   View Slide

2. Secrets
   Passwords, API tokens, SSL Certificates, or any other sensitive
   information your application needs to access something else.
   @joatmon08
   

   View Slide

3. Secrets Management
   Stores and manages secrets.
   @joatmon08
   

   View Slide

4. Rosemary Wang
   (She/Her)
   Developer Advocate at HashiCorp
   joatmon08.github.io
   @JOATMON08 JOATMON08
   LINKEDIN.COM/IN/
   ROSEMARYWANG
   

   View Slide

5. HashiCorp Vault
   Open source secrets manager.
   @joatmon08
   

   View Slide

6. ▪ Storage (retrieve via GET request)
   ▪ Revocation (expire using leases)
   ▪ Rotation (change sensitive information)
   @joatmon08
   

   View Slide

7. Terms You
   Need to
   Know
   Your administrator
   likely configured
   these for you.
   Auth Methods.
   Use these to authenticate to
   Vault.
   ▪ AppRole
   ▪ GitHub
   ▪ JWT/OIDC
   Secrets Engines.
   Use these to rotate and
   retrieve secrets.
   ▪ Key-value store
   ▪ Database usernames and
   passwords
   ▪ API Token
   @joatmon08
   

   View Slide

8. Patterns for Secrets
   Injection
   

   View Slide

9. @joatmon08
   GET SECRETS
   AUTHENTICATE
   TO SECRETS
   MANAGER
   SECRETS INJECTION
   RUN
   APPLICATION
   Write a Client
   

   View Slide

10. Summary Benefits
    ▪ Good for static secrets
    ▪ Can be unit tested
    ▪ Secure because in memory
    Problems
    ▪ Need application reload or
    separate thread for new
    secrets
    ▪ Connection failure for
    secrets manager
    ▪ Doesn’t scale for dynamic
    secrets
    @joatmon08
    

    View Slide

11. @joatmon08
    GET SECRETS
    AUTHENTICATE
    TO SECRETS
    MANAGER
    SECRETS INJECTION
    VAULT AGENT
    RUN
    APPLICATION
    Read Secrets Async in Separate Process
    FILE OF
    SECRETS
    

    View Slide

12. Summary Benefits
    ▪ Separation of concerns
    ▪ Handles changing secrets
    ▪ No additional code
    ▪ File caches secrets
    Problems
    ▪ Requires separate process
    ▪ Application must reload if
    file changes
    ▪ Secrets in file (less
    secure?)
    @joatmon08
    

    View Slide

13. What if your application doesn’t
    have reload capability?
    @joatmon08
    

    View Slide

14. @joatmon08
    GET SECRETS
    AUTHENTICATE
    TO SECRETS
    MANAGER
    SECRETS INJECTION
    RUN
    APPLICATION
    Read Secrets & Reload Application
    FILE OF
    SECRETS
    VAULT AGENT CONSUL TEMPLATE
    

    View Slide

15. Prerequisites
    learn.hashicorp.com/tutorials/vault/dotnet-vault-agent
    ▪ .NET SDK 5.0
    ▪ Docker
    ▪ Docker Compose
    

    View Slide

16. References
    ▪ Official tutorial:
    – learn.hashicorp.com/tutorials/vault/dotnet-httpclient
    – learn.hashicorp.com/tutorials/vault/dotnet-vault-agent
    ▪ vaultproject.io/docs/secrets/kv
    ▪ vaultproject.io/docs/secrets/databases
    ▪ github.com/hashicorp/vault-guides/pull/308
    @joatmon08
    

    View Slide