Don't use ENV variables for secret data (2017)
diogomonica.com
Don't use ENV variables for secret data (2017)
1–10 of 147 posts
Re: Don't use ENV variables for secret data (2017)
#2[deleted]
Re: Don't use ENV variables for secret data (2017)
#3Every production product I’ve ever worked on, the entire team put database credentials in the environment variables.
Re: Don't use ENV variables for secret data (2017)
#4Every production product I’ve ever worked on, the entire team put database credentials in the environment variables.
It's way better than hard coding them into the code.
Re: Don't use ENV variables for secret data (2017)
#5We have recently started removing credentials in env vars and started using google secret manager (previously berglas) and its been amazing so far. AWS and azure should have the same. More challenging when you don’t have all the infrastructure and services in place (ie. when working on plain VPS or other systems without those tools)
Re: Don't use ENV variables for secret data (2017)
#6Every production product I’ve ever worked on, the entire team put database credentials in the environment variables.
It's way better than hard coding them into the code.
Why is that?
Also, as an aside: The very premise of plaintext credentials for computer-computer database connections always seemed strange to me. Maybe I'm just not knowledgeable enough here, but I wish the standard for database credentials was key-based.
Re: Don't use ENV variables for secret data (2017)
#7I don't agree at all. The reasons in the article all seem like "envs are bad because if you make a mistake you can expose them". This is not exclusive to envs, it applies to all secrets, independent of the medium used to make it available to the process using it.
In my experience, if you prevent using envs for secrets (as docker swarm does) all you get is a disgruntled programmer reading the contents of a secret file to an env in the entrypoint.
Re: Don't use ENV variables for secret data (2017)
#8And fix it by making it dependent on something docker specific?
Re: Don't use ENV variables for secret data (2017)
#9The way I got around this was to store secrets in Google KMS encrypted files in Google Cloud Storage. The KMS key and encrypted files share the same name and can be accessed by that name programmatically. This secret storage method works really well for me and lets you easily access & manage secrets across all environments. It's so convenient, I sometimes even use this system as a simple key/value store.
Re: Don't use ENV variables for secret data (2017)
#10Earlier quoted context omitted.
It's way better than hard coding them into the code.
Why is that? Also, as an aside: The very premise of plaintext credentials for computer-computer database connections always seemed strange to me. Maybe I'm just not knowledgeable enough here, but I wish the standard for database credentials was key-based.
> Why is that?
You don't want to accidentally commit your credentials to github and have the world see them. At least if they're in ENV they stay private as long as your environment does.