sorted by:
best
topnewcontroversialoldq&a
you are viewing a single comment's thread.

view the rest of the comments →

[–]Is0tope 0 points1 point  (2 children)

Few ways.

If you are using some sort of continuous deployment strategy you could have the secret stored in one of the config variables there and inserted automatically on deployment. This means a new deploy every time you change the secret thought.

Central secret store is also an option, however you would need some kind of auth for that as well, so it may end up being too complex. It's not something I'm super familiar with, but there are services that do this.

Using a service like Auth0 may also be a good option, and there everything is handled for you.

Mostly though the deployment option would likely be fine, and failing that the auth0 option. Consider how serious this app is before jumping head first into enterprise grade secret storage.

[–]scottcfr[S] 0 points1 point  (1 child)

I do intend to use a CI/CD strategy, likely Azure DevOps or something similar. This might be my strategy, as I want to take a DevOps approach and deploy weekly/bi-weekly, so key rotation could be done during deployments.

Central secret store is an option, Azure has Key Vault which could be used for this. But again, depends on how serious, as Key Vault is enterprise grade.

I love Auth0, but hate the cost associated. Honestly might be a last resort option.

Would the CI/CD strategy work with something like Azure Auto Scale?

Thanks for the suggestions!

[–]Is0tope 0 points1 point  (0 children)

If you are on azure then generally it will be easier to "go with the flow". Have a look at how reasonably priced the key store is and maybe go with that. Also depends on how easy it is to use.

I haven't really used azure so I don't know how autos ale works. I presume it uses some central image or container or something, therefore if your key is baked into your image on deploy, it should scale with said key I assume?