Download to read offline
More Related Content
Similar to Secure deployments keeping your application secrets private - condensed
Secure deployments keeping your application secrets private - condensed
- 1. SECURE DEPLOYMENTS KEEPING YOUR SECRETSPRIVATE Henry Been "Locks" (CC BY-NC-ND 2.0) by wolf4max
- 2.
- 3. THE NEED FORSECRET MANAGEMENT Develop Build Deploy Operate Dev Ops DevOps
- 4. Access and secretmanagement goals No team member needs to hold production secrets Principle of least privilege Decouple authentication from authorization Secure storage of Secrets
- 6. WONDERING WHO IS THATGUY? HENRY BEEN Independent Devops & Azure Architect E: consultancy@henrybeen.nl T: @henry_been L: linkedin.com/in/henrybeen W: henrybeen.nl
- 7. Approach 1 USING RELEASEORCHESTRATOR VSTS Secrets Azure Web AppCode
- 8. Scenario: • As ateam you do CD of your code • You do not do CD of your infrastructure USING RELEASE ORCHESTRATOR VSTS Secrets Azure Web AppCode
- 9. DEMO TIME! USING RELEASEORCHESTRATOR
- 10. USING RELEASE ORCHESTRATOR •Secrets are pretty secure • Easy to start with • Fits existing situations • You see and copy secrets • Secrets visible in portal • Duplication of secrets • Cannot roll secrets easily Pros Cons
- 11. Prerequisite: Have primary& secondary secrets 1. Change the secret in release orchestrator to secondary secret 2. Release 3. Roll primary secret 4. Change the secret in release orchestrator to primary secret 5. Release 6. Roll secondary secret Intermezzo: Roll a secret
- 12. Approach 2 USING ARMTEMPLATES Azure Web App Key Vault VSTSCode & Infra
- 13. Scenario: • As ateam you do CD of your code • You also do CD of your infrastructure USING ARM TEMPLATES Azure Web App Key Vault VSTSCode & Infra
- 14. DEMO TIME! USING ARMTEMPLATES
- 15. USING ARM TEMPLATES •No manual copying or sharing of secrets • No more manual duplication of Azure keys • Secrets visible in portal • Still cannot roll secrets easily Pros Cons
- 16. Approach 3 DIRECTLY FROMKEY VAULT VSTS Azure Web App Code & Infra Key Vault
- 17. Scenario: 1. You doCD of both infrastructure and code 2. You are allowed to provision to the AD DIRECTLY ACCESS KEY VAULT VSTS Azure Web App Code & Infra Key Vault
- 18. HOWTO: Local Development 1.Grant your developer account access to (another) Key Vault • Best alternative • Requires your machine to be in the same AD domain 2. Only use Key Vault in Azure (locally use Web.config) • You have to write code to do this (though pretty straightforward) 3. Manually create a development identity and use that • However… do not check secrets into source control
- 19. DEMO TIME! DIRECTLY ACCESSKEY VAULT
- 20. DIRECTLY ACCESS KEYVAULT • No manual copying or sharing of secrets • No more duplication of Azure keys • Secrets no longer visible in portal • Changed secrets are automatically picked up • Only available on Azure Web Apps, Azure Functions and DataFactory V2 Pros Cons
- 21. Approach 4 DIRECTLY ACCESSSERVICE VSTS Azure Web App Code & Infra AAD Other Service
- 22. Scenario: 1. You doCD of both infrastructure and code 2. You are allowed to provision to the AD 3. Service support DIRECTLY ACCESS SERVICE VSTS Azure Web App Code & Infra AAD Other Service
- 23. DEMO TIME! DIRECTLY ACCESSSERVICE
- 24. DIRECTLY ACCESS SERVICE •No more secrets • Only available on Azure Web Apps, Azure Functions and DataFactory V2 • Only on supported services Pros Cons
- 25. Supported services • AzureResource Manager • Azure Key Vault • Azure Data Lake • Azure SQL DB • Azure Event Hubs • Azure Service Bus • Azure Storage https://docs.microsoft.com/en-us/azure/active-directory/managed-service-identity/services-support-msi
- 26. "Sloten op debrug" (CC BY-NC-ND 2.0) by Jan Brünemann RECAP WHAT TO USE WHEN
- 27. Use your releaseorchestrator Let team operations deploy NEVER EVER EVUHRR When you deploy only code Keyvault and ARM templates When you also deploy infra Application identity / KeyVault When available and allowed Application identity / Oauth resource When available and allowed WHAT TO USE WHEN?
- 28. SECRET MANAGEMNT USING CONFIG BUILDERS FORLOCAL AND CLOUD DEVELOPMENT Requires: • (.NET Framework ≥ 4.7.1 &&.NET Framework 4.7.1 Development Tools) || ASP.NET Core ≥ 2.0
- 29.
- 30. "Fail #2" (CCBY-NC-ND 2.0) by zaipe
- 31.
- 32.
- 33.
- 34. DO TRY THISAT HOME! HENRY BEEN Independent Devops & Azure Architect E: consultancy@henrybeen.nl T: @henry_been L: linkedin.com/in/henrybeen W: henrybeen.nl
Editor's Notes
- #2 "Locks" (CC BY-NC-ND 2.0) by wolf4max
- #3 Some questions: Who is practicing DevOps? Just CI/CD? Or more? How do you do secrets? And uhm… do you roll them frequently? And how?
- #4 * In the old days, we developers did not really care about secrets - ops did that * And now we're doing DevOps and we have to manage deployments (for which you need secrets) * In the old days, we didn't really care about configuring the application host / website with secrets - ops did that * And now we're doing DevOps and we create (and confgure) infrastructure from source control So there are new responsibilities coming up for us as developers Or if your team is partially dev, partially ops: you have to reconcile your fast moving pace and get your ops guys into this pipeline things
- #27 "Sloten op de brug" (CC BY-NC-ND 2.0) by Jan Brünemann
- #31 I spent the better part of a day to make this even work "Fail #2" (CC BY-NC-ND 2.0) by zaipe