How do you manage sensitive keys when using foreign developers?

• Spruce

  2 350 3.7 Go

  A BOSH template merge tool (by geofffranks)

  The CI/CD has a service account with permissions to all envs, and during deployment it renders the config files and inserts the "real" values by pulling it from Vault/KMS. Something very simple is Spruce, which is actually a powerful general templating tool but I've seen it only used for vault secrets so far.

• Vault

  62 24,356 9.9 Go

  A tool for secrets management, encryption as a service, and privileged access management

  

  There's a central key management service. Hashicorp Vault is pretty much the de-facto standard and most other tools integrate nicely with this. The only exception I've seen if companies are fully invested into a single cloud provider, in which case their cloud native alternative is used (AWS KMS, GCP KMS, Azure Keyvault). Even then, sometimes Vault is used as a frontend with the Cloud KMS as backing store.

• SonarLint

  www.sonarlint.org

  sponsored

  Deliver Cleaner and Safer Code - Right in Your IDE of Choice!. SonarLint is a free and open source IDE extension that identifies and catches bugs and vulnerabilities as you code, directly in the IDE. Install from your favorite IDE marketplace today.

  

Suggest a related project