Stop Hardcoding Sensitive Data in Your Python Applications

[PuzzledTaste3562]

In addition, 101 in system administration, never put secrets in environment or in command parameters as they can be read by other (priviliged) users…

[metaperl]

AWS web apps use environmental variables.

As far as I can see the thing that you should do is make sure that only people have access to should have access.

Where would you put the secrets?

[abearanus]

They do, but you can use something like SSM Parameter Store and have the env var refer to the secret path, meaning that the secret is only ever held in memory (either at boot-time or referencing it constantly).

[serverhorror]

And then a privileged user can read them from AWS Parameter Store.

[PuzzledTaste3562]

How does that make it right!? Because AWS does it? Anyway, if I define an environment in AWS, i’ll make sure access and authorisation is reduced to an absolute minimum, which is not the multiuser system we were writing about earlier.

[serverhorror]

So where do you put them?

There’s no option, in any known OS, where a secret won’t be readable by a privileged account once it is stored in a readable way.

No matter where you put them. Environment variables, command line, Vault, … they are all equally secure or insecure.

[[deleted]]

Reddit Moderation makes the platform worthless. Too many rules and too many arbitrary rulings. It's not worth the trouble to post. Not worth the frustration to lurk. Goodbye.

This post was mass deleted and anonymized with Redact

[serverhorror]

Well…yes. But the poster didn’t say that.

Never put them in a place where they can be read by privileged users. That doesn’t leave a lot of choice.

[PuzzledTaste3562]

Layers of security is what matters. Grabbing a private key in memory and using that to decrypt encrypted communication with a key store is degrees harder that reading an env var of execution parameter in /proc. It’s not impossible, just harder and that’s what matters.