Your Secrets in Cloud-Based Key Management Services
summary
Stack Overflow moves secrets from repos into Google KMS, storing ciphertext in a Google Cloud Storage bucket and decrypting at runtime with a custom kms.py module. The code calls cryptoKeys.encrypt/decrypt via OAuth credentials (KMS caps inputs at 64 KB), secrets exist only in memory when services run, and every decrypt is logged for audit. Deployment started August, used by four engineers across ~20 services, falls back to Blackbox, and reports no KMS-caused failures so far. key rotation audit logs
AI-written summary · about
chapters (13)
- 0:00Intro
- 0:53Why did we start talking about secrets
- 2:02How do you know if something is secure
- 3:56How do we manage secrets
- 8:38Risk control
- 9:54Key management service
- 12:19Google Key Management Service
- 16:25Local Key Management
- 17:32IT Tools
- 19:05Bucket Request
- 20:57Usage
- 21:41Recap
- 22:27Questions
related talks
29mManaging Secrets in Your Cloud Environment
51mUsing Key Management Service for data protection
41mModern Security with Microservices and the Cloud
20mApplication Secret Management with AWS KMS
46mSecuring Secrets in the GitOps era
47mEnd-to-end Encryption in Cloud Services
45mLet's Encrypt Everything, Really Everything
51mKey Management 101: DEKs, KEKs, and Credentials Living Together, Oh My!