Upgrade to Pro — share decks privately, control downloads, hide ads and more …

A Developer's Guide to Secrets Management

A Developer's Guide to Secrets Management

How do you as a developer use a secrets manager to protect application API tokens, keys, passwords, certificates, and more? In this session, I'll walk through some patterns of storing and using secrets that never change to secrets that change all the time. By learning how to use a secrets manager as a developer, you can keep your secrets a secret and limit the blast radius for a potential attack. You'll get hands on with HashiCorp Vault and .NET Core and figure out the best way to inject your secrets into your application.

Rosemary Wang

December 04, 2020
Tweet

More Decks by Rosemary Wang

Other Decks in Programming

Transcript

  1. Copyright © 2020 HashiCorp
    A Developer’s Guide
    to Secrets
    Management
    WWCode Connect Forward
    December 2020

    View Slide

  2. Secrets
    Passwords, API tokens, SSL Certificates, or any other sensitive
    information your application needs to access something else.
    @joatmon08

    View Slide

  3. Secrets Management
    Stores and manages secrets.
    @joatmon08

    View Slide

  4. Rosemary Wang
    (She/Her)
    Developer Advocate at HashiCorp
    joatmon08.github.io
    @JOATMON08 JOATMON08
    LINKEDIN.COM/IN/
    ROSEMARYWANG

    View Slide

  5. HashiCorp Vault
    Open source secrets manager.
    @joatmon08

    View Slide

  6. ▪ Storage (retrieve via GET request)
    ▪ Revocation (expire using leases)
    ▪ Rotation (change sensitive information)
    @joatmon08

    View Slide

  7. Terms You
    Need to
    Know
    Your administrator
    likely configured
    these for you.
    Auth Methods.
    Use these to authenticate to
    Vault.
    ▪ AppRole
    ▪ GitHub
    ▪ JWT/OIDC
    Secrets Engines.
    Use these to rotate and
    retrieve secrets.
    ▪ Key-value store
    ▪ Database usernames and
    passwords
    ▪ API Token
    @joatmon08

    View Slide

  8. Patterns for Secrets
    Injection

    View Slide

  9. @joatmon08
    GET SECRETS
    AUTHENTICATE
    TO SECRETS
    MANAGER
    SECRETS INJECTION
    RUN
    APPLICATION
    Write a Client

    View Slide

  10. Summary Benefits
    ▪ Good for static secrets
    ▪ Can be unit tested
    ▪ Secure because in memory
    Problems
    ▪ Need application reload or
    separate thread for new
    secrets
    ▪ Connection failure for
    secrets manager
    ▪ Doesn’t scale for dynamic
    secrets
    @joatmon08

    View Slide

  11. @joatmon08
    GET SECRETS
    AUTHENTICATE
    TO SECRETS
    MANAGER
    SECRETS INJECTION
    VAULT AGENT
    RUN
    APPLICATION
    Read Secrets Async in Separate Process
    FILE OF
    SECRETS

    View Slide

  12. Summary Benefits
    ▪ Separation of concerns
    ▪ Handles changing secrets
    ▪ No additional code
    ▪ File caches secrets
    Problems
    ▪ Requires separate process
    ▪ Application must reload if
    file changes
    ▪ Secrets in file (less
    secure?)
    @joatmon08

    View Slide

  13. What if your application doesn’t
    have reload capability?
    @joatmon08

    View Slide

  14. @joatmon08
    GET SECRETS
    AUTHENTICATE
    TO SECRETS
    MANAGER
    SECRETS INJECTION
    RUN
    APPLICATION
    Read Secrets & Reload Application
    FILE OF
    SECRETS
    VAULT AGENT CONSUL TEMPLATE

    View Slide

  15. Prerequisites
    learn.hashicorp.com/tutorials/vault/dotnet-vault-agent
    ▪ .NET SDK 5.0
    ▪ Docker
    ▪ Docker Compose

    View Slide

  16. References
    ▪ Official tutorial:
    – learn.hashicorp.com/tutorials/vault/dotnet-httpclient
    – learn.hashicorp.com/tutorials/vault/dotnet-vault-agent
    ▪ vaultproject.io/docs/secrets/kv
    ▪ vaultproject.io/docs/secrets/databases
    ▪ github.com/hashicorp/vault-guides/pull/308
    @joatmon08

    View Slide