Segurança e governança em infraestrutura - secrets management na prática

An in-depth look at secrets management in infrastructure automation highlights the importance of protecting sensitive data. This series delves into three key pillars: secrets management, policy as code, and least privilege in IAM. The first topic focuses on the challenge of safeguarding secrets without storing them in plain text.

Common pitfalls include committing secrets in Terraform.tfvars files, embedding cloud credentials directly in CI configuration files, and storing Terraform state files which contain sensitive information. The solution lies in using a dedicated, secure system for storing secrets with access controls, auditing, and rotation. The HashiCorp Vault system is the most widely used solution in the IaC ecosystem.

Its core concepts include secrets engines for generating and storing secrets, leases for automatic revocation of dynamic secrets, and access policies to define read/write permissions. Alternatives like AWS Secrets Manager offer simplicity when working within a single cloud provider but lack the flexibility and multi-cloud integration of Vault.

The series demonstrates how to set up a local Vault instance for experimentation and how to securely store and retrieve secrets using the KV secrets engine. Terraform integration is also covered, demonstrating how to fetch secrets in real-time without committing them to version-controlled Terraform files. Dynamic secrets engines in Vault create temporary credentials with automatic expiration, providing a higher level of security.