Ask HN: Secure and simple way for secret/credential management in a startup? • Hacker News Board

Re: Ask HN: Secure and simple way for secret/credential management in a startup?

#31

Post by fatnoah » Tue, Mar 07, 2023, 3:47 PM UTC

mycentstoo wrote: post #13

A few suggestions: 1. Application / service to service secrets should be handled either by Vault or AWS Param Store. Both are good. AWS Param Store is easier but less feature rich. Ideally, your Vault instance would have the database engine which allows for automatic rotation and password management of databases like Postgres. 2. Developers should only have access to AWS through SSO using something like Okta. Okta ha…

This is pretty much how my startup is running things, with the exception that we're using credstash for #1.

Re: Ask HN: Secure and simple way for secret/credential management in a startup?

#32

Post by Dowwie » Wed, Mar 08, 2023, 4:25 PM UTC

atmosx wrote: post #30

Dowwie wrote: post #12

Earlier quoted context omitted.

Warning to anyone interested in Vault. Vault policies involve a learning curve. Maybe they have improved documentation and examples since I learned Vault management but I remember how complicated and time consuming it was.

For a small team I wouldn't go there. Except if the product requires a higher level of security and we have no money to spend on the SaaS or self-hosting is a requirement.

The problem isn't self-hosting. It's the ongoing setup and management through their DSL.

Re: Ask HN: Secure and simple way for secret/credential management in a startup?

#33

Post by 3np » Wed, Mar 08, 2023, 5:26 PM UTC

Dowwie wrote: post #32

atmosx wrote: post #30

Earlier quoted context omitted.

For a small team I wouldn't go there. Except if the product requires a higher level of security and we have no money to spend on the SaaS or self-hosting is a requirement.

The problem isn't self-hosting. It's the ongoing setup and management through their DSL.

FWIW, If you don't require the single-pane management, some scenarios can be simplified by deploying additional individual clusters/instances with separate access rather than controlling only via policy.

Mentioning since I've def seen people get stuck and forget to consider the obvious.

Re: Ask HN: Secure and simple way for secret/credential management in a startup?

#34

Post by igorzij » Thu, Mar 09, 2023, 12:20 PM UTC

Doppler is nice. Also AWS has Parameter Store (lower level, cheaper) and Secret Manager. You could also use built-in secret storage in Github / Gitlab for CI workflows.