Replacing Long-lived Passwords with Dynamic Secrets

In this presentation, I explain how to replace long-lived and hardcoded passwords with dynamic secrets, managed by access policies and revoked after use.

This version of the talk was given at the 2023 Edition of Atlanta Cloud Conference.

Transcript

1. Replacing Long-lived Passwords
   with Dynamic Secrets
   

   View Slide

2. Sr. Developer Advocate at HashiCorp
   he / him
   @ksatirli
   Kerim
   Satirli
   

   View Slide

3. CMS Configuration
   CraftCMS.env
   # Required variables:
   CRAFT_APP_ID=...
   CRAFT_ENVIRONMENT=dev
   CRAFT_SECURITY_KEY=...
   # Database-specific variables:
   CRAFT_DB_DRIVER=postgresql
   CRAFT_DB_SERVER=postgresq.service.us-east-2.consul
   CRAFT_DB_PORT=5342
   CRAFT_DB_DATABASE=atlcc
   CRAFT_DB_USER=ethan
   CRAFT_DB_PASSWORD=AW96B6
   CRAFT_DB_SCHEMA=public
   CRAFT_DB_TABLE_PREFIX=atlcc
   

   View Slide

4. CMS Configuration
   .gitignore
   ### CraftCMS ###
   .env
   # Caches
   /cache
   /cache-db
   # Log files
   *.log
   logs/*
   

   View Slide

5. 01
   Security is Hard.
   

   View Slide

6. View Slide

7. Your Secrets
   Won’t Be.
   

   View Slide

8. Challenge:
   Hard-coded Secrets
   

   View Slide

9. Challenge:
   Rotating Secrets
   

   View Slide

10. Solution:
    Defence-in-Depth
    

    View Slide

11. !
    

    View Slide

12. Static Secrets
    02
    

    View Slide

13. Demo:
    KV v2
    

    View Slide

14. Dynamic Secrets
    03
    

    View Slide

15. Dynamic Secrets
    created when needed, not weeks ago
    can be revoked manually, if need be
    allow for highly specific policies per secret
    expire at a pre-set interval
    

    View Slide

16. CSP Secrets
    https://vault.svcs.dev:8200/ui/vault/secrets/aws-us-west-2/credentials/uploader
    

    View Slide

17. https://vault.svcs.dev:8200/ui/vault/secrets/aws-us-west-2/credentials/uploader
    CSP Secrets
    

    View Slide

18. >
    CSP Secrets via the CLI
    Terminal
    vault read aws-us-west-2/creds/uploader
    Key Value
    --- -----
    lease_id l3knWmDm1XBjSOIFtCrHT4ZD
    lease_duration 1m
    lease_renewable true
    access_key AKIATI4IYJK5TXW644LA
    secret_key ********************************
    

    View Slide

19. resource "vault_aws_secret_backend" "main" {
    access_key = var.aws_access_key
    secret_key = var.aws_secret_key
    default_lease_ttl_seconds = 60
    path = "aws"
    region = each.key
    }
    CSP Secrets Configuration via Terraform
    secrets_backends.tf
    

    View Slide

20. {
    "Version": "2012-10-17",
    "Statement": [
    {
    "Action": [
    "s3:DeleteObject",
    "s3:GetObject",
    "s3:ListObjectsV2",
    "s3:PutObject"
    ],
    "Effect": "Allow",
    "Resource": [
    "arn:aws:s3:::${S3_BUCKET_NAME}",
    "arn:aws:s3:::${S3_BUCKET_NAME}/*"
    ]
    }, {
    "Action": [
    "cloudfront:CreateInvalidation"
    ],
    iam-policy-uploader.tmpl.json
    Policy Template
    

    View Slide

21. Security is
    a Team Sport.
    

    View Slide

22. Thank you
    speakerdeck.com/ksatirli
    

    View Slide