We simply store our secrets in a KMS-encrypted file in S3. When containers start up, they have a bootstrap script that deserializes it and fills it with the appropriate variables.

At some point though I think we will look at Parameter Store and Secrets Manager. If I were starting this company again, that's where I'd look first.

Many will suggest Vault, which I hear is a fine product. However, it's one more thing that can fail, and this is a pretty big thing because if you can't access passwords and security tokens, most systems will totally stop working. If you are using a public cloud environment, I would look at tools native to that environment that are managed for you.

https://www.envkey.com/ helps manage your team's secrets and configuration.

EnvKey takes a minimalistic and developer-friendly approach to managing configuration and secrets. It keeps secrets safe while also making it extremely easy to make them available wherever you need them, edit them, and grant/revoke access.

With EnvKey, you can just set a single environment variable (ENVKEY=...) and have any dev machine or server fully configured in seconds. It's a lot simpler and (imho) more pleasant to work with than alternatives.

I'm happy to answer questions about it here if anyone has them!

https://github.com/coreos/vault-operator

https://aws.amazon.com/secrets-manager/

I mostly like credstash because I independently arrived at the same design for securing secrets before I knew it existed. And many of my security minded friends are excited to try out the AWS service.