kkamperschroer

As I was reading your comment I was thinking "whoa, that sounds like Damien or Robert" and sure enough :)

Hope you are doing well!

Nice! The FUSE mounting method for obtaining secrets is similar to how Keywhiz does this. Very cool and novel solution. Though, if you are unfortunate enough to still have Windows servers in your architecture, I think you're out of luck.

Fantastic. Thank you!

So if you potentially need to roll a secret you would just run your deployment playbook limited to the secrets task?

Cool, thanks! Seems like a pretty direct competitor to AWS KMS. The pricing is identical, so I guess the choice between the two is quite obvious if you are hosted in Azure or AWS.

That's very similar to the problem we are encountering. Getting the secrets to the machines at deploy time isn't too bad, but then they are available to a potential attacker.

Accessing secrets as needed at runtime instead requires some kind of extremely reliable service nearby. This is what I find most concerning about Vault since it can lock on you if the cluster goes down.

Do you take advantage of Consul's ACL system them for limiting access to secrets? Also, do you have any form of auditing then when using consul?

Thanks for your input!

That's an interesting solution. I guess this would really only work though if you are self hosted, right?

Thanks!

Nice, thank you! I haven't heard of that one.

Thanks for the tip. I guess the easiest thing to do is use git-crypt with some encrypted file and have the secrets available at deploy time, but I'm worried about long term disadvantages to this approach. Rolling secrets would then require a deployment of at least that secrets file and restarting the services, or writing them in a way they read the file every time they need the secret.

Since our stack isn't on AWS, it kind of throws out AWS KMS and Lyft Confidant (since it is built on AWS). I'll keep digging into Vault and the other options put forward in this thread. Thanks again.

I found my current position at AttackPattern here on HN a year ago, and I really love it. I would highly recommend others check it out.