https://github.com/tellerops/teller works good for me.
At work we use Ansible to fetch secrets from Hashicorp Vault.
Ask HN: What tools should I use to manage secrets from env files?
21–30 of 83 posts
Re: Ask HN: What tools should I use to manage secrets from env files?
#22I use a hybrid approach of .env files and whatever secret manager my cloud platform has available (in this case, AWS Secrets Manager), where anything that's sensitive that needs to be present within the .env file is essentially a macro that gets resolved later by a library I've written.
For example, my .env file may have something like this in it:
DB_PASSWORD = @AWS::db_password
Whenever my library reads a value that begins with `@AWS::`, it knows to resolve (and cache) that value by querying AWS's Secrets Manager at runtime and looking for the config setting set there (`db_password` in this case).
This is nice because I can check-in these .env files since they don't contain anything sensitive, but still gives me the flexibility to hard-code in secrets when working locally in my dev env.
Re: Ask HN: What tools should I use to manage secrets from env files?
#23You could put them all in Secrets Manager or Parameter Store, whichever is appropriate for the secret, then have your CI process fetch the secrets and setup your environment. That way, developing locally does not depend on access to AWS Secrets Manager or Parameter Store.
Re: Ask HN: What tools should I use to manage secrets from env files?
#24This is an interesting alternative to password manager, esp. if you want to version control your secrets https://github.com/getsops/sops
Sops is probably ideal for lowest ceremony possible. Combine this with direnv for a seamless experience.
If you don't want to commit/share secrets you could avoid sops and put this in your direnv envrc: `[ -e ~/.local/secrets/myproj.env ] && source ~/.local/secrets/myproj.env`
Re: Ask HN: What tools should I use to manage secrets from env files?
#25The tl;dr here is:
1. Load secrets dynamically at runtime
2. Share internal creds via e.g. 1Pass
Environment variables (+managing them with .env files) are a better start than putting keys in your codebase, but this can also be leaky/hard to keep up to date.
Most cloud providers have some sort of secret management tool. Vault by Hashicorp is another solid option if you want to run your own.
If you’re hosted on AWS, I’m personally a big fan of Credstash[0], which is basically a simple wrapper around DynamoDB+KMS.
Cheaper than the AWS Secrets product and fast enough.
I previously built a config that would take secrets from Credstash, env vars, and .env files (in that order). This offered the best of both worlds for local and remote deployments.
Re: Ask HN: What tools should I use to manage secrets from env files?
#26Don't store secrets in env files. Use a secrets manager and a password manager. Configure SSO for everything. Use MFA for everything. Rotate your keys regularly. Do not allow long-lived user accounts to exists.
https://aws.amazon.com/secrets-manager/ https://keepersecurity.com/
What is a long-lived user account? https://g.co/gemini/share/84c224b18bf0
Re: Ask HN: What tools should I use to manage secrets from env files?
#27If you want an overview of available tools, I published one a while ago: https://hsm.tunnel53.net/article/secrets-management/
If you want something simpler, have a look at SOPS: https://github.com/getsops/sops
Re: Ask HN: What tools should I use to manage secrets from env files?
#28You can have a shared password manager, 1password is good for this. I forgot how expensive it is, but for families its like 3 euros
Re: Ask HN: What tools should I use to manage secrets from env files?
#29IP whitelisting. Use private IPs and VPN (for connecting to developement platform)
This way credentials leak will not do much
Re: Ask HN: What tools should I use to manage secrets from env files?
#30This is an interesting alternative to password manager, esp. if you want to version control your secrets https://github.com/getsops/sops
I'm a huge fan of SOPS, especially since it can integrate with numerous crypto providers, from `age` for a fully offline crypto source to Hashicorp Vault and big cloud secret / crypto providers.
I wanted a tool that allowed me to store secrets safely without tossing them in plain text env files called `sops-run`. It manages yaml manifests to store your environment variables based on the name of the binary you're running, and only applies the environment variables to the context of app you're running. I never did tidy this up into an installable python package so it can't be easily installed with pipx yet (I keep putting off finishing all of that, pull requests welcome ;-) ), but I like it better than simply using direnv or equivalents, since it doesn't load the environment variables into the shell context, though it could probably be combined with it to hot-load shell aliases for the commands you want to run.