search

clingen-data-model / curator

0 stars 0 forks source link

Restrict repository secret access #6

Closed theferrit32 closed 3 years ago

theferrit32 commented 3 years ago

Right now repo is private due to credentials in the source tree. In order to make the repo public we need to remove and revoke those tokens, and put GCP service account credentials in the repository secrets. Before doing that we need to restrict access to this repo so that only specific users can read/manage repo secrets, not just anyone in the org.

Might be able to use github org teams. By default users with collaborator role on the repo can access secrets.

larrybabb commented 3 years ago

@sjahl Please let me know if you need me to create a new github repo for the curator app assuming we have to eventually make it public and remove the secrets that are contained in it. Otherwise you can close or take over this ticket to help sort out how we've setup the secrets thus far.

sjahl commented 3 years ago

I agree with what @tnavatar said in our chat on Friday -- I don't think there's a security concern with keeping the firebase key checked into source.

One recommendation that the docs have, is adding restrictions to the key. The general idea is that you limit which web apps/ip addresses/etc are allowed to use the key (https://firebase.google.com/docs/projects/api-keys#apply-restrictions). The primary concern there is resource quota theft rather than exposing anything secret... so maybe something we want to think about for staging/production deployments.

sjahl commented 3 years ago

Closing here, since I don't think there's anything that needs to be done.