Ask HN: Secure and simple way for secret/credential management in a startup?

- Where possible enable SSO, even for AWS or other cloud services (https://blog.leapp.cloud/how-to-saml-federate-your-aws-accou...). Here an example on how to do it with GSuite and aws

- For all your employees I can advice you Leapp as open-source project (https://github.com/Noovolari/leapp). It solve mayor of the problem listed here:

. Responsable for the AWS infrastructure get the IAM Security standard on track (short-lived credentials, MFA, IAM Users secured, rotation of credentials and access to the console with a set of secured credentials, and generation of Azure ceredentials)

. temporary tokens are mandatory, so let a project like leapp locally manage IAC credentials for you.

- Is not too strictly to manage pipelines only after confirmation? You can create a specific role for managing a specific policy to deploy your pipelines. Here an article on how to start organizing your AWS account as a startup (https://blog.leapp.cloud/aws-multi-account-strategy-explaine...)

- "People work on their own devices.": that's why Leapp has been created, check it out.

- Optional: "It would be good if developers get credentials to setup small test environments in AWS." how anout creating a sandbox account for them? - "Bonus: How to manage non-technical secrets" even here, Leapp is a desktop app and is vastly used also for accessing to EC2 instances even for not technical people

I hope this guide can help you!

1) Make the perfect pitch for your startup: https://www.ratherlabs.com/post/how-to-make-the-perfect-pitc...

2) Network Effects: https://www.ratherlabs.com/post/network-effects-how-can-it-i...

At my current gig we're using doppler[^1] (no affiliation) for application secrets. We're using doppler with their kubernetes operator which supports auto-rotation on secrets. Secrets are set as "env variables". So far, doppler has not suffer big outages or we did not notice, because the operator will keep working even if their API is down - of course you won't get updates. Access control could be more _fine grained_ and they added secret auto-rotation option recently[^2]. We don't use that yet.

I've been a happy 1Password user (no affiliation) and we use it company wide to share user secrets. 1Password support CI/CD integration IIRC, so in theory should cover most use cases.

If you can pay for AWS Vault, the terraform integration comes out of the box. However if you're a small team running vault might be a daunting task and you're inserting another SPoF.

There are many open source application secrets tools that you could check out though. In the past I had great experience with credstash[^3]. Credstash is a really simple and secure open source solution that is based on AWS KMS, IAM and DynamoDB. Costs pennies to run for medium size deployments. Once you setup and document the way to use it, it's really easy. The downside is that as a tool is pretty _raw_ you have to build things like "secret generators", etc. But combined with a slack bot can be a really powerful, secure, cost-effective self-hosted solution that doesn't require maintenance (as opposed to solutions like Vault).

If you have specific questions about any of the above tools feel free to drop an email. I'll happy to answer questions.

[^1]: https://www.doppler.com/

[^2]: Auto-rotation is complicated because you need to integrate the auto-rotation with external tools yourself most of the times. There are Hashi-Vault modules for SQL DBs but not for Mailgun or CloudFlare for example.

[^3]: https://github.com/fugue/credstash