Ask HN: Secure and simple way for secret/credential management in a startup?

What is a simple and secure tool to manage secrets and credentials for a small startup?

How do you do it?

This is not a core of the business. It should be easy to use and configure so a paid service would also be good.

Consider the the following typical situation:

1. Small startup with about 10 technical people.

2. One or two are responsible for the infrastructure in the cloud like AWS, Azure, ...

3. There are also other third party services like Cloudflare, Datadog, ...

4. Everything (AWS, Datadog, ...) is managed with IaC tools like Terraform, Pulumi, (Ansible). These tools need secrets to work. The simplest way for giving the secrets to the tools is via environment variables or .env files.

5. People work on their own devices. So security cannot be absolutely guaranteed. So I guess MFA and generated temporary tokens should be used if possible. To generate temporary tokens the secrets management service has to work e.g. with AWS.

6. Optional: It would be good if Terraform can also be run in the CI/CD pipeline but only after confirmation of one of the 2 infrastructure persons.

7. Optional: It would be good if developers get credentials to setup small test environments in AWS. You can create IAM roles that only allow to create these, but you still have to manage the secrets for these.

8. Bonus: How to manage non-technical secrets, e.g. credentials for web shops to order supplies? Multiple people would have to order something. Store it all on a confluence page?

I think a password manager like 1pass for all secrets (definitely not confluence) plus a cloud hosted secret system like Aws secretsmanager for secrets that need to be accessed programmatically e.g by various IAM roles.

Devs, once assumed a role, download the secret env files from secretsmanager.

You might see where I'm going with this, you have two systems to store secrets in, one for general use and one for programmatic use. It's not ideal but pragmatic and do consider if your in a security sensitive domain, then you would want to customise this process e.g. by only having one storage system and shorter access etc.

Someone of the two infra people would have the ability to assume a role/get a set of expiring "deploy" keys that they would paste into CI To start a deployment (still in ci just doing stuff that CI normally doesn't have permission to do)

Hashicorp Vault. Checks all your boxes, I think.

Or for something more lightweight (though it sounds like you're just about getting to the size where something more instrumented is worth it), you can have a git repo with secrets encrypted with individual keys. (git-secret and pass are two of the more popular ones here)

> 8. Bonus: How to manage non-technical secrets, e.g. credentials for web shops to order supplies? Multiple people would have to order something.

Probably using a separate system. Bitwarden, 1Password, KeepassXC.

1Password for all the logins, 1Password Secrets Automation for all the infrastructure stuff.

Each user has their own vault of personal logins and related items, then various groups can have shared vaults with shared logins.

Using it with almost 100 people company wide.. working well so far!

BitWarden just announced secret management.

https://bitwarden.com/products/secrets-manager/

For AWS definitely use SSO with short lived credentials and proper landing zone setup.