Ask HN: Secure and simple way for secret/credential management in a startup?

1. Application / service to service secrets should be handled either by Vault or AWS Param Store. Both are good. AWS Param Store is easier but less feature rich. Ideally, your Vault instance would have the database engine which allows for automatic rotation and password management of databases like Postgres.

2. Developers should only have access to AWS through SSO using something like Okta. Okta has MFA through it's own authenticator app (not through SMS).

3. Password sharing should be handled with something like sops or if you need a more lightweight solution - Password Pusher. Sops works really well for hiding credentials within code that needs to be deployed. A team managed 1Password instance works well too.

4. Terraform should inherit a role that gives permissions to run against infrastructure. That role should be short lived and limited to running in a CI/CD environment (preferably on your own runner if that's possible).

5. You should have a separate AWS environment for running test projects. You can do this virtually (localstack) or physically through having a separate AWS account. I prefer the later since it's the real thing and implements all the APIs. Localstack can be decent though. If I had to setup an organization now, I would have a minimum of 3 AWS accounts. One for production infrastructure, one for staging environments and one for test environments. I would also add in AWS Budget Alerts and Cost Anomaly detection to prevent huge spend on it.

https://news.ycombinator.com/item?id=34955699

All secrets are in a file on there. I make it a file of exports I source before launching the app. Backup the file in 1pw.

Secrets get deployed along with the app to a server also secured with ssh and a firewall/VPC.

Maybe doesn't scale to an org chart, but a scrappy startup of 3-5 with some contractors and it works well. This method allows you to literally have a single VPS prod host and a single VPS deploy box. That's $10 and super simple and completely cloud-agnostic.