EPIC: Secret Management

[JJediny]

acceptance criteria:

• [ ] solution must leverage FEDRAMP approved services for the secret store/vault (e.g. AWS KMS)
• [ ] solution/procedure must protect the secret from leakage in CI
  • [ ] an honest mistake by the development team
  • [ ] malicious actor - changes ci config or code to expose/print it in the output of automated CI build as a Pull Request.

references:

• https://github.com/fugue/credstash
• https://github.com/winebarrel/gcredstash
• https://github.com/mozilla/sops
• https://secrethub.io/
• https://git-secret.io/

[afeld]

What kinds of secrets you have in mind? I think most projects have been using environment variables in CircleCI, which does have FedRAMP Tailored/Li-SaaS.

[JJediny]

Agreed, created this issue to get that ^ documented; also to track our conversations with GSA GRACE for establishing an accepted process for managing "secrets in CI" at GSA with Secops concurrence/support.