Keep secrets out of code and logs
1. Keep secrets out of code and logs
Who your user is, what they may do, where that gets checked: all settled. But your application holds credentials of its own, a database password, a partner API key. Most of those leak somewhere ordinary, in a config file or a debug log.2. Not everything sensitive is a secret
Start by naming what you are holding. A secret is a credential: something a stranger could use to act as you. Sensitive data is a fact about a person. Config is neither.3. Not everything sensitive is a secret
Personal data gets two names. PII is personally identifiable information. PHI is protected health information. In a bank, your PIN is a secret and your statement is sensitive. A thief wants one, a stalker wants the other.4. Four ways a secret gets out
A secret sitting in a secrets service is safe. In a running system it has four ways out. Two you create on purpose: source code, where the history keeps it after you delete the line, and environment variables.5. Four ways a secret gets out
The other two are usually accidents. A log line prints the whole request object. A stack trace carries the connection string it failed on. Neither felt important enough to scrub.6. Encrypted at rest is not hidden
Environment variables deserve a closer look, because they feel like the safe choice. Lambda always encrypts them at rest with a KMS key.7. Encrypted at rest is not hidden
That protects the stored bytes, not the value. Anyone who can read the function's configuration sees plain text. It is a sealed envelope on a shared desk: a storage answer to an access question.8. Which store, and why
So put it somewhere built for secrets. AWS gives you two options and they are not interchangeable. Secrets Manager is a secrets service. Parameter Store, part of Systems Manager, is a configuration service that holds secrets too.9. Which store, and why
Four things decide it. Managed rotation on a schedule, which only Secrets Manager offers. Cross-account sharing, through a Secrets Manager resource policy. Versioning, which both provide. And cost: forty cents per secret each month, against ten thousand standard parameters free.10. Read it fresh, cache it briefly
Now the runtime side. Your code calls GetSecretValue at startup, with a role scoped to that one secret and the KMS key behind it. Nothing is baked into the package.11. Read it fresh, cache it briefly
Calling it on every request is slow and expensive, so cache the value in memory. That part is right. Cache it forever, and you have made a new problem.12. Rotation moves the value under you
Why four steps and not one swap? Because the new password has to exist and be proven to work at the database before anything is told to use it. A single swap would break every client the moment the new value turned out to be wrong.13. Rotation moves the value under you
So Secrets Manager creates the new value as AWSPENDING, sets it on the target, and tests it. Only then does finishSecret move the AWSCURRENT label. The old value becomes AWSPREVIOUS, which keeps it reachable from the store, not working at the database. The database stopped accepting it the moment rotation finished.14. Rotation moves the value under you
Your cached copy hears none of this. It is a phone number you memorized, dialing fine until the day it does not. Give the cache a lifetime of minutes, and refresh on an authentication failure.15. Mask, redact, stay debuggable
Last exits: your logs and traces. Sanitization means cleaning data before it is written, not after. Masking keeps the shape and hides the value, like a receipt showing a card's last four digits.16. Mask, redact, stay debuggable
Redaction removes the value and leaves a marker. Redact everything and you are debugging blind, so keep the request ID and drop the token. Ask which fields a stranger could use.17. Mask, redact, stay debuggable
Why does that work? The fields on-call needs are config: identifiers, timestamps, status codes, worth nothing to a stranger. The ones worth stealing are the secret and the sensitive data, and they trace nothing. Two different sets, so sanitizing costs you almost no debugging.18. Let's practice!
Time to put secret handling into practice with a few questions.Create Your Free Account
or
By continuing, you accept our Terms of Use, our Privacy Policy and that your data is stored in the USA.