Confidant: an open-source secret management service
1–10 of 71 posts
Re: Confidant: an open-source secret management service
#2That's very nice. If you're using Microsoft Azure though, you might as well use Azure Key Vault[0].
Re: Confidant: an open-source secret management service
#3An alternative approach, if you don't want to be 100% tied to KMS, is https://github.com/mozilla/sops . It uses KMS, but also PGP, and potentially anything that comes up in the future.
Re: Confidant: an open-source secret management service
#4That's very nice. If you're using Microsoft Azure though, you might as well use Azure Key Vault[0]. [0] https://azure.microsoft.com/en-us/services/key-vault/
[deleted]
Re: Confidant: an open-source secret management service
#5"KMS provides access to master encryption keys,... but doesn’t provide direct access to the master key itself, so it can’t be stolen."
Doesn't Amazon KMS have access to the master key? And therefore, it can be stolen from them?
Re: Confidant: an open-source secret management service
#6We use ZeroTier to encrypt our AWS microservices traffic. Way easier to setup and just ... works.
Re: Confidant: an open-source secret management service
#7"KMS provides access to master encryption keys,... but doesn’t provide direct access to the master key itself, so it can’t be stolen." Doesn't Amazon KMS have access to the master key? And therefore, it can be stolen from them?
https://aws.amazon.com/kms/faqs/
"AWS KMS is designed so that no one has access to your master keys."
Re: Confidant: an open-source secret management service
#8We use ZeroTier to encrypt our AWS microservices traffic. Way easier to setup and just ... works.
This is a bit different from network encryption (which is really valuable). This is a centralized location for services to store and retrieve secrets, like passwords to external services, SSL keys, etc..
Re: Confidant: an open-source secret management service
#9An alternative approach, if you don't want to be 100% tied to KMS, is https://github.com/mozilla/sops . It uses KMS, but also PGP, and potentially anything that comes up in the future.
A big +1 for SOPS. We've used it with great success.
Re: Confidant: an open-source secret management service
#10How does this compare to Vault? [1]
Looks like Confidant is tied to AWS whereas Vault can use various backends..?