Don't use ENV variables for secret data (2017)

Re:Don't use ENV variables for secret data (2017) by gchamonlive on Monday July 13, 2020 @10:43AM (#23821275)

Cloud lock-in (not being able for example to manage cross-platform credentials) and cost.

By itself AWS Secrets Manager is fine, but as with everything AWS, billing is pretty opaque. If you couple this with a poorly planed Lambda setup, costs can potentially uncontrollably scale.

For what you are paying, AWS Secrets Manager seems too barebones/rigid.

[ Parent | on HN ]

Re:Don't use ENV variables for secret data (2017) by tyingq on Monday July 13, 2020 @11:22AM (#23821715)

Lock in shouldn't be too bad. It's create, get, set, list, delete, describe. I imagine the API footprint isn't much different if you switch over to something else. Most apps will just use get().

[ Parent | on HN ]

Re:Don't use ENV variables for secret data (2017) by gchamonlive on Monday July 13, 2020 @12:36PM (#23822655)

It shouldn't, but it can be very bad. And with vault you potentially circumvent that and end up with a tool that is way more flexible than Secrets Manager.

[ Parent | on HN ]