Each services should be secured, demanding some form of authorization in order to interact with it. In order to obtain that authorization at runtime, in a secure way, services will use hashicorp Vault. The service should exchange an authentication credential (which will be provided through the config) with the secrets service for an authorization credential for a specific service.
The scope and nature of the granted authorization are to be determined. At this time, I am not certain of the expectations or limitations of vault. This secrets solution should be easily replaced, in case the deployment environment offers an integrated solution, but the general authorization pattern should still be followed:
credentials are not passed through the config (env vars)
credentials are not stored in the build
credentials are obtained at runtime
credentials are obtained in the same way across all environments (no env-specific app code)
TODO:
Set up the Vault dev server in the dev environment (docker-compose) as the secrets.
Configure the Vault dev server to provide a database username and password.
Update the api and database services to connect using the credentials provided by the secrets service.
Configure the Vault dev server to protect the database credentials with an authentication mechanism.
Configure the api service to authenticate with the secrets service to facilitate the database connection.
natearn
commented
4 years ago
Each services should be secured, demanding some form of authorization in order to interact with it. In order to obtain that authorization at runtime, in a secure way, services will use hashicorp Vault. The service should exchange an authentication credential (which will be provided through the config) with the
secretsservice for an authorization credential for a specific service.The scope and nature of the granted authorization are to be determined. At this time, I am not certain of the expectations or limitations of vault. This secrets solution should be easily replaced, in case the deployment environment offers an integrated solution, but the general authorization pattern should still be followed:
TODO:
secrets.apianddatabaseservices to connect using the credentials provided by thesecretsservice.apiservice to authenticate with thesecretsservice to facilitate the database connection.