A simple solution if you are in AWS is S3 with instance profiles for access.
Ask HN: In a microservice architecture, how do you handle managing secrets?
11–20 of 60 posts
Re: Ask HN: In a microservice architecture, how do you handle managing secrets?
#12Another option for your list, which you'll have to evaluate for your use case: https://wiki.openstack.org/wiki/Barbican I've been evaluating most of these same options for my use case, but haven't made any decisions yet.
Nice, thank you! I haven't heard of that one.
Re: Ask HN: In a microservice architecture, how do you handle managing secrets?
#13A simple solution if you are in AWS is S3 with instance profiles for access.
Yes, but is there a succinct howto on this?
Re: Ask HN: In a microservice architecture, how do you handle managing secrets?
#14I'm pretty happy with this solution from Strongauth. http://keyappliance.strongauth.com/ You can secure the root for it with TPM or HSM.
That's an interesting solution. I guess this would really only work though if you are self hosted, right?
Thanks!
Re: Ask HN: In a microservice architecture, how do you handle managing secrets?
#15It also depends on how secret it needs to be. For most of our secrets (those used for configuration) we use Consul.
Do you take advantage of Consul's ACL system them for limiting access to secrets? Also, do you have any form of auditing then when using consul?
Thanks for your input!
Re: Ask HN: In a microservice architecture, how do you handle managing secrets?
#16Azure Key Vault! Disclosure: am dev in Azure, although not on this specific product.
Re: Ask HN: In a microservice architecture, how do you handle managing secrets?
#17it's a huge pain point for us. We're a .NET shop rolling our own that mimics/overlays app.config and web.config patterns for both dev and production usage. Our concern is less on how do you get the secrets to the box (though that's obviously important) and more on how do you keep an attacker who has started penetrating your infrastructure from gaining control of the infrastructure that holds your secrets.
That's very similar to the problem we are encountering. Getting the secrets to the machines at deploy time isn't too bad, but then they are available to a potential attacker.
Accessing secrets as needed at runtime instead requires some kind of extremely reliable service nearby. This is what I find most concerning about Vault since it can lock on you if the cluster goes down.
Re: Ask HN: In a microservice architecture, how do you handle managing secrets?
#18it's a huge pain point for us. We're a .NET shop rolling our own that mimics/overlays app.config and web.config patterns for both dev and production usage. Our concern is less on how do you get the secrets to the box (though that's obviously important) and more on how do you keep an attacker who has started penetrating your infrastructure from gaining control of the infrastructure that holds your secrets.
Have you had a look at the new ASP.NET Configuration classes? [1]
I hate having to manage web.config but I get your point about keeping attackers at bay (and not providing pivot points).
[1]: http://docs.asp.net/en/latest/fundamentals/configuration.htm...
Re: Ask HN: In a microservice architecture, how do you handle managing secrets?
#19Azure Key Vault! Disclosure: am dev in Azure, although not on this specific product. https://azure.microsoft.com/en-us/services/key-vault/
Cool, thanks! Seems like a pretty direct competitor to AWS KMS. The pricing is identical, so I guess the choice between the two is quite obvious if you are hosted in Azure or AWS.
Re: Ask HN: In a microservice architecture, how do you handle managing secrets?
#20[deleted]