Ask HN: Tools for Managing Secret in Production Scale? Hi all, I'm looking for centralized tools for managing secrets for my engineering team right now. Is there any recommended tools from your experience using them in production? For example like Vault (Hashicorp product). Thanks |
We simply store our secrets in a KMS-encrypted file in S3. When containers start up, they have a bootstrap script that deserializes it and fills it with the appropriate variables.
At some point though I think we will look at Parameter Store and Secrets Manager. If I were starting this company again, that's where I'd look first.
Many will suggest Vault, which I hear is a fine product. However, it's one more thing that can fail, and this is a pretty big thing because if you can't access passwords and security tokens, most systems will totally stop working. If you are using a public cloud environment, I would look at tools native to that environment that are managed for you.
https://www.envkey.com/ helps manage your team's secrets and configuration.
EnvKey takes a minimalistic and developer-friendly approach to managing configuration and secrets. It keeps secrets safe while also making it extremely easy to make them available wherever you need them, edit them, and grant/revoke access.
With EnvKey, you can just set a single environment variable (ENVKEY=...) and have any dev machine or server fully configured in seconds. It's a lot simpler and (imho) more pleasant to work with than alternatives.
I'm happy to answer questions about it here if anyone has them!
I mostly like credstash because I independently arrived at the same design for securing secrets before I knew it existed. And many of my security minded friends are excited to try out the AWS service.