Secrets Management: Automation and Tools

Table of Contents

Secrets management is a critical component of securing sensitive information like API keys, passwords, tokens, and certificates in modern DevOps workflows. Automating secrets management ensures that secrets are securely stored, accessed, and rotated without manual intervention, reducing the risk of data breaches.

This guide explores the concepts, tools, and best practices for automating secrets management using tools like HashiCorp Vault, AWS Secrets Manager, Azure Key Vault, and Kubernetes Secrets. Hands-on examples and step-by-step instructions are included for practical implementation.

Why Automate Secrets Management?

Key Benefits

Enhanced Security:
- Prevent unauthorized access to sensitive information.
Compliance:
- Meet regulatory requirements for data security (e.g., GDPR, HIPAA).
Efficiency:
- Automate secrets rotation, distribution, and management.
Auditability:
- Track access and changes to secrets for better visibility.

For an overview, refer to OWASP Secrets Management Recommendations.

Key Tools for Secrets Management

1. HashiCorp Vault

Securely store, access, and rotate secrets.
Supports dynamic secrets for databases and cloud providers.

2. AWS Secrets Manager

Manages secrets for AWS applications and infrastructure.
Automates secrets rotation for RDS, Redshift, and more.

3. Azure Key Vault

Stores keys, certificates, and secrets securely.
Integrates with Azure services and third-party tools.

4. Kubernetes Secrets

Stores sensitive data in Kubernetes clusters.
Natively integrates with containerized applications.

Step-by-Step Guide to Automating Secrets Management

Scenario: Automate secrets management for a Kubernetes-based application using HashiCorp Vault and AWS Secrets Manager.

1. Automate Secrets Management with HashiCorp Vault

1.1: Install HashiCorp Vault

Run Vault in a Docker container:

docker run -d --name vault -p 8200:8200 vault

Initialize Vault:

export VAULT_ADDR='http://127.0.0.1:8200'
vault operator init > init.txt

Unseal Vault using the keys from init.txt:

vault operator unseal <unseal-key-1>
vault operator unseal <unseal-key-2>
vault operator unseal <unseal-key-3>

Authenticate with the root token:
```
vault login <root-token>
```

1.2: Store and Retrieve Secrets

Enable the secrets engine:
```
vault secrets enable -path=secret kv
```

Add a secret:

vault kv put secret/myapp/api-key value=my-secret-api-key

Retrieve the secret:
```
vault kv get secret/myapp/api-key
```

1.3: Automate Secrets Injection

Use the Vault Agent to inject secrets into your application:

Create a configuration file vault-agent-config.hcl:

exit_after_auth = false
pid_file = "./pidfile"

auto_auth {
  method "token" {
    config = {
      token = "<root-token>"
    }
  }
}

template {
  source      = "./templates/api-key.tpl"
  destination = "./secrets/api-key.txt"
}

Start the Vault Agent:

vault agent -config=vault-agent-config.hcl

Verify the injected secret in ./secrets/api-key.txt.

2. Automate Secrets Management with AWS Secrets Manager

2.1: Store Secrets

Create a secret:

aws secretsmanager create-secret --name MyAppSecret --secret-string '{"username":"admin","password":"my-secret-password"}'

Verify the secret:

aws secretsmanager get-secret-value --secret-id MyAppSecret

2.2: Automate Secrets Rotation

Enable rotation for the secret:

aws secretsmanager rotate-secret --secret-id MyAppSecret --rotation-lambda-arn <lambda-arn>

Write a Lambda function for rotation:

import boto3
import os

def lambda_handler(event, context):
    client = boto3.client('secretsmanager')
    secret_id = event['SecretId']
    token = event['ClientRequestToken']
    step = event['Step']

    if step == 'createSecret':
        # Generate a new secret value
        new_secret = "new-secret-password"
        client.put_secret_value(SecretId=secret_id, ClientRequestToken=token, SecretString=new_secret)

Deploy the Lambda function and link it to the rotation configuration.

3. Manage Secrets in Kubernetes

3.1: Create a Kubernetes Secret

Encode your secret in Base64:
```
echo -n "my-secret-api-key" | base64
```

Create a secret YAML file:

apiVersion: v1
kind: Secret
metadata:
  name: myapp-secret
data:
  api-key: bXktc2VjcmV0LWFwaS1rZXk=

Apply the secret:
```
kubectl apply -f secret.yaml
```

3.2: Inject Secrets into Pods

Update your pod configuration:

env:
  - name: API_KEY
    valueFrom:
      secretKeyRef:
        name: myapp-secret
        key: api-key

Apply the updated pod configuration:
```
kubectl apply -f pod.yaml
```

Verify the secret in the pod:

kubectl exec -it <pod-name> -- env | grep API_KEY

4. Advanced Features

4.1: Dynamic Secrets with HashiCorp Vault

Generate database credentials dynamically:

vault write database/roles/my-role db_name=my-db creation_statements="CREATE USER '{{name}}' WITH PASSWORD '{{password}}';" default_ttl="1h"

4.2: Secrets Auditing

Enable audit logging in Vault:

vault audit enable file file_path=/var/log/vault_audit.log

Best Practices

Rotate Secrets Regularly:
- Implement automated rotation policies to minimize exposure.
Use Role-Based Access Control (RBAC):
- Restrict access to secrets based on the principle of least privilege.
Encrypt Secrets:
- Always encrypt secrets at rest and in transit.
Monitor Access:
- Track and audit secret access to detect potential misuse.
Avoid Hardcoding Secrets:
- Never embed secrets directly in code or configuration files.

Official Resources

Conclusion

Automating secrets management is essential for securing sensitive data and ensuring compliance in modern infrastructure. By leveraging tools like HashiCorp Vault, AWS Secrets Manager, and Kubernetes Secrets, you can implement scalable, secure, and efficient secrets management systems. Regularly review and refine your processes to align with best practices and evolving security standards.