Implement key management procedures

gcdevops / HRWhiteListing

MIT License

2 stars 0 forks source link

Implement key management procedures #152

Closed jaysonmc closed 4 years ago

jaysonmc commented 4 years ago

Security requirement.

Please document how we are securing keys required for the application

Detailed comment in this issue
Reference to documentation
An issue or PR that addresses this issue

CalvinRodo commented 4 years ago

Things to consider:

Where keys are stored
How keys are rotated
Who has access and is doing this

jaysonmc commented 4 years ago

https://azure.microsoft.com/en-ca/services/key-vault/

@EricDube please document implementation regarding @CalvinRodo's comments, then close (if met, which I am assuming is the case with default functionality)

EricDube commented 4 years ago

The keys are currently stored in Azure KeyVault and a TTL has been set. The ops team for this project has access to the keys and are able to rotate before TTL is up.