Ask HN: How do you share secret configs with your team members?

#1

Post by poudels14 » Sun, Nov 29, 2020, 9:09 PM UTC

I always struggle to share secret configs with someone else working on the same project. I wonder if there is a secure way that HN community uses that I don't know about. Thanks!

Re: Ask HN: How do you share secret configs with your team members?

#2

Post by davismwfl » Sun, Nov 29, 2020, 9:23 PM UTC

We use 1Password and shared vaults. Allows us to permission control who sees what and who has access to things. Honestly, it makes things super easy overall. Not saying it is perfect, but it takes a lot of the effort out of the process.

We will probably start looking at a way to automate the downloading of the files from 1Password via the command line tool, that way it can be fully automated for deployments right from our deployment box. Right now a human still has to grab the secrets file and make it available for the deployment script, which isn't as ideal but it is simple and better IMO then sending a file around where multiple copies start to exist which could cause a problem with deployments.

Re: Ask HN: How do you share secret configs with your team members?

#3

Post by poudels14 » Mon, Nov 30, 2020, 12:14 AM UTC

davismwfl wrote: post #2

We use 1Password and shared vaults. Allows us to permission control who sees what and who has access to things. Honestly, it makes things super easy overall. Not saying it is perfect, but it takes a lot of the effort out of the process. We will probably start looking at a way to automate the downloading of the files from 1Password via the command line tool, that way it can be fully automated for deployments right fro…

Thanks for the info. using 1Password is a neat trick!

Re: Ask HN: How do you share secret configs with your team members?

#4

Post by bradknowles » Mon, Nov 30, 2020, 2:11 AM UTC

For things that are deployed on AWS, I would recommend AWS Secrets Manager or SSM Parameter Store. Two different options for similar use cases.

Of course, you have to build your tooling so as to pull these parameters out and put them where they are needed at the time of deployment, but at least you’re handing off the storage and distribution of these secrets to another entity that has a lot more experience in doing so.