secrets-management

Secrets Management Security

Quick Navigation: Level 1: Quick Start (5 min) → Level 2: Implementation (30 min) → Level 3: Mastery (Extended)

Level 1: Quick Start (<2,000 tokens, 5 minutes)

Core Principles

1. Never Hardcode Secrets: Use environment variables, secret management systems, or secure vaults
2. Rotate Regularly: Implement automated rotation policies for all secrets
3. Detect and Prevent: Use pre-commit hooks and scanning tools to prevent secret leaks
4. Least Privilege: Grant minimum required access to secrets
5. Encrypt Everywhere: Encrypt secrets at rest and in transit

Essential Checklist

• No secrets in code: All secrets stored externally (Vault, env vars, secrets manager)
• Pre-commit hooks: git-secrets or TruffleHog configured to prevent commits
• Environment variables: .env files used locally, never committed to git
• Secret rotation: Automated rotation policies implemented
• Access control: RBAC/ABAC policies enforce least privilege access
• Audit logging: All secret access logged with timestamps and user IDs
• Certificate management: TLS/mTLS certificates managed centrally
• Detection tools: Regular scans with multiple tools (TruffleHog, git-secrets, Gitleaks)

Quick Example

# @nist sc-12 "Cryptographic key management"
# @nist sc-13 "Cryptographic protection"
import os
from hashicorp_vault import VaultClient
from cryptography.fernet import Fernet

# ❌ NEVER do this
# API_KEY = "sk-1234567890abcdef"
# DATABASE_PASSWORD = "my_secure_password"

# ✅ Use environment variables
API_KEY = os.getenv('API_KEY')
if not API_KEY:
    raise ValueError("API_KEY environment variable not set")

# ✅ Use HashiCorp Vault for sensitive secrets
vault = VaultClient(url=os.getenv('VAULT_ADDR'), token=os.getenv('VAULT_TOKEN'))
db_credentials = vault.read_secret('database/prod')
DB_PASSWORD = db_credentials['password']

# ✅ Encrypt sensitive data
def encrypt_sensitive_data(data: str) -> bytes:
    """Encrypt sensitive data using Fernet symmetric encryption."""
    key = os.getenv('ENCRYPTION_KEY').encode()
    cipher = Fernet(key)
    return cipher.encrypt(data.encode())

# ✅ Never log secrets
def authenticate_api(api_key: str):
    """Authenticate with API using key."""
    # Log without exposing secret
    print(f"Authenticating with key: {api_key[:8]}...")  # Only show prefix