Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
Taming secrets with Vault
Search
Jérémy Courtial
June 13, 2017
Programming
0
83
Taming secrets with Vault
Video:
https://www.youtube.com/watch?v=fZDd4-McNSU
Jérémy Courtial
June 13, 2017
Tweet
Share
More Decks by Jérémy Courtial
See All by Jérémy Courtial
sudo give the cloud
mrartichaut
0
25
An introduction to AppSec?
mrartichaut
0
43
Secure by design: introduction to threat modeling
mrartichaut
0
51
Lead Tech: Empowering the team
mrartichaut
0
47
Web Platform Security
mrartichaut
0
47
go doSomeThing()
mrartichaut
0
52
Practical Cryptography : Data Encryption
mrartichaut
0
61
Practical Cryptography : Password Hashing
mrartichaut
1
73
HTTP/2 : One connection to rule them all
mrartichaut
1
60
Other Decks in Programming
See All in Programming
5つのアンチパターンから学ぶLT設計
narihara
1
170
Rubyでやりたい駆動開発 / Ruby driven development
chobishiba
1
730
生成AI時代のコンポーネントライブラリの作り方
touyou
1
220
レベル1の開発生産性向上に取り組む − 日々の作業の効率化・自動化を通じた改善活動
kesoji
0
230
Agentic Coding: The Future of Software Development with Agents
mitsuhiko
0
100
今ならAmazon ECSのサービス間通信をどう選ぶか / Selection of ECS Interservice Communication 2025
tkikuc
21
4k
PHP 8.4の新機能「プロパティフック」から学ぶオブジェクト指向設計とリスコフの置換原則
kentaroutakeda
2
910
Deep Dive into ~/.claude/projects
hiragram
14
2.6k
High-Level Programming Languages in AI Era -Human Thought and Mind-
hayat01sh1da
PRO
0
780
Webの外へ飛び出せ NativePHPが切り拓くPHPの未来
takuyakatsusa
2
560
脱Riverpod?fqueryで考える、TanStack Queryライクなアーキテクチャの可能性
ostk0069
0
160
猫と暮らす Google Nest Cam生活🐈 / WebRTC with Google Nest Cam
yutailang0119
0
120
Featured
See All Featured
Building Adaptive Systems
keathley
43
2.7k
The Art of Delivering Value - GDevCon NA Keynote
reverentgeek
15
1.5k
Designing for Performance
lara
610
69k
Navigating Team Friction
lara
187
15k
Design and Strategy: How to Deal with People Who Don’t "Get" Design
morganepeng
130
19k
Keith and Marios Guide to Fast Websites
keithpitt
411
22k
The Myth of the Modular Monolith - Day 2 Keynote - Rails World 2024
eileencodes
26
2.9k
Large-scale JavaScript Application Architecture
addyosmani
512
110k
Building Applications with DynamoDB
mza
95
6.5k
Templates, Plugins, & Blocks: Oh My! Creating the theme that thinks of everything
marktimemedia
31
2.4k
Performance Is Good for Brains [We Love Speed 2024]
tammyeverts
10
960
CSS Pre-Processors: Stylus, Less & Sass
bermonpainter
357
30k
Transcript
Taming secrets with Vault Jérémy Courtial - Software Security Architect
Oodrive
Secrets & Sensitive data
zookeeper: hosts: zk.services.net environment: dev datasource: driverClassName: org.postgresql.Driver username: tk_user
password: qS5Ji;*bY*pX,94~gepF management: enabled: true context-path: /manage health: enabled: true master-key: YXplcnR5dWlvcHFzZGZnaGprbG13eGN2Ym4sOzo9QCMK server: port: 8080
zookeeper: hosts: zk.services.net environment: dev datasource: driverClassName: org.postgresql.Driver username: tk_user
password: qS5Ji;*bY*pX,94~gepF management: enabled: true context-path: /manage health: enabled: true master-key: YXplcnR5dWlvcHFzZGZnaGprbG13eGN2Ym4sOzo9QCMK server: port: 8080
Why bother?
Traditional security
Traditional security
Trusted network Traditional security
Trusted network def this_is_fine eval(someStr) end Traditional security
Traditional security
"I’m simply saying that hackers, uh… finds a way." Dr.
Ian Malcolm
Defense in depth Don't rely on a single line of
defense
Defense in depth Don't assume threats stop at the gateway
Defense in depth Try smaller trust boundaries
From..
To…
To…
CPU RAM root To… Secrets go here persistent storage users
network?
Traceability & Management
Where are our secrets?
Who can access them?
When are they accessed?
How do we rotate them?
We want those answers BEFORE we need them
The right tool SCM? Configuration management? Secrets management tool
Lots of secrets management tools nowadays Keywhiz (Square) Confidant (Lyft)
KMS (Amazon) Docker Secret
Open Source Multiple storage backends Standalone microservice API & CLI
High availability Encryption-as-a-Service Multiple types of secrets Audit friendly Authentication & Authorization
Demo
$ vault write secret/srvA/credentials pwd=azerty Success! Data written to: secret/srvA/credentials
$ vault read secret/srvA/credentials Key Value --- ----- refresh_interval 768h0m0s
pwd azerty
$ vault read /sys/policy/my-service-A path "secret/srvA/*" { capabilities = ["read"]
}
$ curl https://vault01/v1/secret/srvA/credentials -H 'X-Vault-Token:…' { "request_id": "f9e9b545-c624-ebbb-1dbd- d35e1074a478",
"lease_id": "", "renewable": false, "lease_duration": 2764800, "data": { "pwd": "azerty" …
Protecting secrets Turtles all the way down
Secrets are encrypted at rest How does Vault protect secrets?
Encryption keys only live in memory How does Vault protect
secrets?
How to obtain the Master Key? How does Vault protect
secrets?
Master key split in N shards K shards required Vault
sealed until a quorum is reached Shamir secret sharing
How do apps access secrets? Ask Vault at runtime Need
an authentication token How to pass the token to the app?
Secure introduction Secure distribution Short token lifetime Access detection
Scheduler Vault Service A
Generate wrapped token Policy: app_front Scheduler Vault Service A
Generate wrapped token Policy: app_front Scheduler Vault Service A wrapping_token:
wrap-token ttl: 1min num_use: 1 wrapped_token: app-token policy:app_front
wrapping_token: wrap-token ttl: 1min num_use: 1 wrapped_token: app-token policy:app_front token:
wrap-token num_use: 1 ttl: 1min Scheduler Vault Service A
Deploy / Start token: wrap-token num_use: 1 ttl: 1min wrapping_token:
wrap-token ttl: 1min num_use: 1 wrapped_token: app-token policy:app_front Scheduler Vault Service A
token: wrap-token num_use: 1 ttl: 1min Unwrap wrapping_token: wrap-token ttl:
1min num_use: 1 wrapped_token: app-token policy:app_front Scheduler Vault Service A
client_token: app-token policy:app_front Scheduler Vault Service A
token: app-token Read secret Scheduler Vault Service A
Secure introduction X X X Secure distribution Short token lifetime
Access detection
Vault @ Oodrive
Vault @ Oodrive One service in staging ZooKeeper as storage
backend "Good enough" introduction
Challenges @ Oodrive Ongoing transition to an orchestrated architecture
Challenges @ Oodrive For now: Puppet. No scheduler.
Challenges @ Oodrive Don't want to break everything twice
Challenges @ Oodrive Puppet Server and init script as "scheduler"
Challenges @ Oodrive Leverage existing Puppet authentication
VaultClient client = new Builder(vaultUri) .withTokenAuth(token) .build(); Credentials cred =
client.readSecret( "secret/my-service/db-credentials", Credentials.class); Vanilla Java Client
@SecretPath("credentials") Secret<Credentials> credentialsSecret; … Credentials cred = credentialsSecret.getValue(); Spring
Hopefully to be open sourced
Best practices
Least Privilege all the way!
Vault as single secrets repository
Secrets grouped under service name
Use roles for easier management
Enable ACL on ZooKeeper
Next steps Fully secure introduction Dynamic secrets (db credentials) Vault
as internal PKI
Thanks Questions? To win!