Hacker News Reader

Comment by SeriousM | Hacker News Reader

How is this any different to Azure key vault? What's the benefit?

I haven't personally used Azure key vault (or Azure in general), but as it looks comparable to AWS Parameter Store, here are a few potential benefits of EnvKey:

- EnvKey is host-agnostic, so if you ever want to migrate to a different host, use an external CI tool, or even just bring up a quick script that relies on some configuration, that's trivial with EnvKey, whereas it might not be so easy with the Azure-specific service.

- EnvKey offers a user-friendly desktop ui for managing configuration across apps, environments, and teams. It allows for some useful things like inheritance and imports/exports. It's also generally better not to manage secrets on the web if you can avoid it (mainly due to browser extensions).

- EnvKey has much simpler access control system.

- EnvKey makes development configuration and secrets a first-class concern, whereas Azure/Parameter Store services tend to focus mainly on only staging/production-level secrets.

- EnvKey uses client-side encryption (OpenPGP) whereas Azure key vault (and Parameter Store) use server-side keys for encryption.

Parameter Store is rather cumbersome and heavyweight for the kind of quick iteration you can do with EnvKey, and of course it's AWS-specific. I do use Parameter Store to "inject" the EnvKey into newly-booted EC2 instances, but then EnvKey takes over from there.

How is it cumbersome and heavyweight? If the app is already using AWS, it's trivial to start using the parameter store.

I was able to abstract it away into a pretty simple Ruby class (for a Rails app) that writes an encrypted S3 file. That file is loaded by my containers into ENV (currently using ECS). Just a couple of method calls to update.

Reply on news.ycombinator.com