A Developer's Guide to Secrets Management

How do you as a developer use a secrets manager to protect application API tokens, keys, passwords, certificates, and more? In this session, I'll walk through some patterns of storing and using secrets that never change to secrets that change all the time. By learning how to use a secrets manager as a developer, you can keep your secrets a secret and limit the blast radius for a potential attack. You'll get hands on with HashiCorp Vault and .NET Core and figure out the best way to inject your secrets into your application.

Transcript

1. Copyright © 2020 HashiCorp A Developer’s Guide to Secrets Management WWCode Connect Forward December 2020
2. Secrets Passwords, API tokens, SSL Certificates, or any other sensitive information your application needs to access something else. @joatmon08
3. Secrets Management Stores and manages secrets. @joatmon08
4. Rosemary Wang (She/Her) Developer Advocate at HashiCorp joatmon08.github.io @JOATMON08 JOATMON08 LINKEDIN.COM/IN/ ROSEMARYWANG
5. HashiCorp Vault Open source secrets manager. @joatmon08
6. ▪ Storage (retrieve via GET request) ▪ Revocation (expire using leases) ▪ Rotation (change sensitive information) @joatmon08
7. Terms You Need to Know Your administrator likely configured these for you. Auth Methods. Use these to authenticate to Vault. ▪ AppRole ▪ GitHub ▪ JWT/OIDC Secrets Engines. Use these to rotate and retrieve secrets. ▪ Key-value store ▪ Database usernames and passwords ▪ API Token @joatmon08
8. Patterns for Secrets Injection
9. @joatmon08 GET SECRETS AUTHENTICATE TO SECRETS MANAGER SECRETS INJECTION RUN APPLICATION Write a Client
10. Summary Benefits ▪ Good for static secrets ▪ Can be unit tested ▪ Secure because in memory Problems ▪ Need application reload or separate thread for new secrets ▪ Connection failure for secrets manager ▪ Doesn’t scale for dynamic secrets @joatmon08
11. @joatmon08 GET SECRETS AUTHENTICATE TO SECRETS MANAGER SECRETS INJECTION VAULT AGENT RUN APPLICATION Read Secrets Async in Separate Process FILE OF SECRETS
12. Summary Benefits ▪ Separation of concerns ▪ Handles changing secrets ▪ No additional code ▪ File caches secrets Problems ▪ Requires separate process ▪ Application must reload if file changes ▪ Secrets in file (less secure?) @joatmon08
13. What if your application doesn’t have reload capability? @joatmon08
14. @joatmon08 GET SECRETS AUTHENTICATE TO SECRETS MANAGER SECRETS INJECTION RUN APPLICATION Read Secrets & Reload Application FILE OF SECRETS VAULT AGENT CONSUL TEMPLATE
15. Prerequisites learn.hashicorp.com/tutorials/vault/dotnet-vault-agent ▪ .NET SDK 5.0 ▪ Docker ▪ Docker Compose
16. References ▪ Official tutorial: – learn.hashicorp.com/tutorials/vault/dotnet-httpclient – learn.hashicorp.com/tutorials/vault/dotnet-vault-agent ▪ vaultproject.io/docs/secrets/kv ▪ vaultproject.io/docs/secrets/databases ▪ github.com/hashicorp/vault-guides/pull/308 @joatmon08