Upgrade to Pro — share decks privately, control downloads, hide ads and more …

A Developer's Guide to Secrets Management

A Developer's Guide to Secrets Management

How do you as a developer use a secrets manager to protect application API tokens, keys, passwords, certificates, and more? In this session, I'll walk through some patterns of storing and using secrets that never change to secrets that change all the time. By learning how to use a secrets manager as a developer, you can keep your secrets a secret and limit the blast radius for a potential attack. You'll get hands on with HashiCorp Vault and .NET Core and figure out the best way to inject your secrets into your application.

Be8b596c46f4c9a1aec6a7586af33134?s=128

Rosemary Wang

December 04, 2020
Tweet

More Decks by Rosemary Wang

Other Decks in Programming

Transcript

  1. Copyright © 2020 HashiCorp A Developer’s Guide to Secrets Management

    WWCode Connect Forward December 2020
  2. Secrets Passwords, API tokens, SSL Certificates, or any other sensitive

    information your application needs to access something else. @joatmon08
  3. Secrets Management Stores and manages secrets. @joatmon08

  4. Rosemary Wang (She/Her) Developer Advocate at HashiCorp joatmon08.github.io @JOATMON08 JOATMON08

    LINKEDIN.COM/IN/ ROSEMARYWANG
  5. HashiCorp Vault Open source secrets manager. @joatmon08

  6. ▪ Storage (retrieve via GET request) ▪ Revocation (expire using

    leases) ▪ Rotation (change sensitive information) @joatmon08
  7. Terms You Need to Know Your administrator likely configured these

    for you. Auth Methods. Use these to authenticate to Vault. ▪ AppRole ▪ GitHub ▪ JWT/OIDC Secrets Engines. Use these to rotate and retrieve secrets. ▪ Key-value store ▪ Database usernames and passwords ▪ API Token @joatmon08
  8. Patterns for Secrets Injection

  9. @joatmon08 GET SECRETS AUTHENTICATE TO SECRETS MANAGER SECRETS INJECTION RUN

    APPLICATION Write a Client
  10. Summary Benefits ▪ Good for static secrets ▪ Can be

    unit tested ▪ Secure because in memory Problems ▪ Need application reload or separate thread for new secrets ▪ Connection failure for secrets manager ▪ Doesn’t scale for dynamic secrets @joatmon08
  11. @joatmon08 GET SECRETS AUTHENTICATE TO SECRETS MANAGER SECRETS INJECTION VAULT

    AGENT RUN APPLICATION Read Secrets Async in Separate Process FILE OF SECRETS
  12. Summary Benefits ▪ Separation of concerns ▪ Handles changing secrets

    ▪ No additional code ▪ File caches secrets Problems ▪ Requires separate process ▪ Application must reload if file changes ▪ Secrets in file (less secure?) @joatmon08
  13. What if your application doesn’t have reload capability? @joatmon08

  14. @joatmon08 GET SECRETS AUTHENTICATE TO SECRETS MANAGER SECRETS INJECTION RUN

    APPLICATION Read Secrets & Reload Application FILE OF SECRETS VAULT AGENT CONSUL TEMPLATE
  15. Prerequisites learn.hashicorp.com/tutorials/vault/dotnet-vault-agent ▪ .NET SDK 5.0 ▪ Docker ▪ Docker

    Compose
  16. References ▪ Official tutorial: – learn.hashicorp.com/tutorials/vault/dotnet-httpclient – learn.hashicorp.com/tutorials/vault/dotnet-vault-agent ▪ vaultproject.io/docs/secrets/kv

    ▪ vaultproject.io/docs/secrets/databases ▪ github.com/hashicorp/vault-guides/pull/308 @joatmon08