Hacker News Reader

100% this.

1. Keep secrets in a dedicated secrets store.

2. Read directly from the secrets store in application code. There is no environment, there are no environment variables. Yes, even on local.

View on HN

It's pretty normal to keep secrets in a dedicated secret store, and then have the service launcher inject them from the secret store into the environment.

normal indeed but not what i'd consider a best practice anymore. we've moved away from any secrets in the env after the typical secrets leak when secrets popped up in some debug logging that hit datadog.

we now have a secret cache layer api and the app loads secrets securely at time of use from that api. there's also no secret-0 problem because we use IAM auth when calling the cache.

edit: for those wondering, api response time is sub 1ms (rust!)

Just to clarify - for every seperate read, update or write to your database - you setup and teardown a new connection?

Your iam token is just a secret by another name. Sure it's more automated but theres no avoiding secret0.

Well you’ll need to know the path in the secret store, so store the path in the environment.

Reply on news.ycombinator.com