Replacing Long-lived Passwords with Dynamic Secrets

Slide 1

Slide 1 text

Slide 2

Slide 2 text

Sr. Developer Advocate at HashiCorp he / him @ksatirli Kerim Satirli

Slide 3

Slide 3 text

CMS Configuration CraftCMS.env # Required variables: CRAFT_APP_ID=... CRAFT_ENVIRONMENT=dev CRAFT_SECURITY_KEY=... # Database-specific variables: CRAFT_DB_DRIVER=postgresql CRAFT_DB_SERVER=postgresq.service.us-east-2.consul CRAFT_DB_PORT=5342 CRAFT_DB_DATABASE=atlcc CRAFT_DB_USER=ethan CRAFT_DB_PASSWORD=AW96B6 CRAFT_DB_SCHEMA=public CRAFT_DB_TABLE_PREFIX=atlcc

Slide 4

Slide 4 text

CMS Configuration .gitignore ### CraftCMS ### .env # Caches /cache /cache-db # Log files *.log logs/*

Slide 5

Slide 5 text

01 Security is Hard.

Slide 6

Slide 6 text

No content

Slide 7

Slide 7 text

Your Secrets Won’t Be.

Slide 8

Slide 8 text

Challenge: Hard-coded Secrets

Slide 9

Slide 9 text

Challenge: Rotating Secrets

Slide 10

Slide 10 text

Solution: Defence-in-Depth

Slide 11

Slide 11 text

Slide 12

Slide 12 text

Static Secrets 02

Slide 13

Slide 13 text

Demo: KV v2

Slide 14

Slide 14 text

Dynamic Secrets 03

Slide 15

Slide 15 text

Dynamic Secrets created when needed, not weeks ago can be revoked manually, if need be allow for highly specific policies per secret expire at a pre-set interval

Slide 16

Slide 16 text

CSP Secrets https://vault.svcs.dev:8200/ui/vault/secrets/aws-us-west-2/credentials/uploader

Slide 17

Slide 17 text

https://vault.svcs.dev:8200/ui/vault/secrets/aws-us-west-2/credentials/uploader CSP Secrets

Slide 18

Slide 18 text

> CSP Secrets via the CLI Terminal vault read aws-us-west-2/creds/uploader Key Value --- ----- lease_id l3knWmDm1XBjSOIFtCrHT4ZD lease_duration 1m lease_renewable true access_key AKIATI4IYJK5TXW644LA secret_key ********************************

Slide 19

Slide 19 text

resource "vault_aws_secret_backend" "main" { access_key = var.aws_access_key secret_key = var.aws_secret_key default_lease_ttl_seconds = 60 path = "aws" region = each.key } CSP Secrets Configuration via Terraform secrets_backends.tf

Slide 20

Slide 20 text

{ "Version": "2012-10-17", "Statement": [ { "Action": [ "s3:DeleteObject", "s3:GetObject", "s3:ListObjectsV2", "s3:PutObject" ], "Effect": "Allow", "Resource": [ "arn:aws:s3:::${S3_BUCKET_NAME}", "arn:aws:s3:::${S3_BUCKET_NAME}/*" ] }, { "Action": [ "cloudfront:CreateInvalidation" ], iam-policy-uploader.tmpl.json Policy Template