Gestion des secrets

---

1 - Types de secrets

1.1 Catégories

Type	Exemples	Risque
Credentials	Passwords, API keys	Accès non autorisé
Certificates	TLS certs, SSH keys	Man-in-the-middle
Tokens	OAuth, JWT	Impersonation
Connection Strings	DB connections	Data breach
Encryption Keys	KMS, AES keys	Data exposure

1.2 Anti-patterns

# ❌ Hardcoded secrets
API_KEY = "sk-12345-secret-key"
DATABASE_URL = "postgres://admin:[email protected]/prod"

# ❌ Secrets dans les logs
logger.info(f"Connecting with key: {api_key}")

# ❌ Secrets dans Git
# .env committed to repository

---

2 - Secrets Detection

2.1 GitLeaks

# .github/workflows/gitleaks.yml
- name: GitLeaks
  uses: gitleaks/gitleaks-action@v2
  env:
    GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

# CLI
gitleaks detect --source . --verbose

# Pre-commit hook
gitleaks protect --staged

2.2 TruffleHog

- name: TruffleHog
  uses: trufflesecurity/trufflehog@main
  with:
    path: ./
    base: ""
    head: ${{ github.ref_name }}
    extra_args: --only-verified

2.3 detect-secrets

# Scan
detect-secrets scan > .secrets.baseline

# Audit
detect-secrets audit .secrets.baseline

# Pre-commit
detect-secrets-hook --baseline .secrets.baseline

2.4 Configuration GitLeaks

# .gitleaks.toml
title = "Custom Gitleaks config"

[[rules]]
id = "aws-access-key"
description = "AWS Access Key"
regex = '''AKIA[0-9A-Z]{16}'''
tags = ["aws", "credentials"]

[[rules]]
id = "custom-api-key"
description = "Custom API Key"
regex = '''myapp_key_[a-zA-Z0-9]{32}'''
tags = ["custom"]

[allowlist]
paths = [
  '''test/.*''',
  '''.*_test\.go'''
]
regexes = [
  '''EXAMPLE_KEY.*'''
]

---

3 - HashiCorp Vault

3.1 Architecture

3.2 Installation

# Helm install
helm repo add hashicorp https://helm.releases.hashicorp.com
helm install vault hashicorp/vault \
    --set "server.ha.enabled=true" \
    --set "server.ha.replicas=3"

3.3 Configuration KV Secrets

# Enable KV engine
vault secrets enable -path=secret kv-v2

# Write secret
vault kv put secret/myapp/config \
    api_key="sk-12345" \
    db_password="secure-password"

# Read secret
vault kv get secret/myapp/config

# List secrets
vault kv list secret/myapp/

3.4 Kubernetes Auth

# Enable Kubernetes auth
vault auth enable kubernetes

# Configure
vault write auth/kubernetes/config \
    kubernetes_host="https://$KUBERNETES_PORT_443_TCP_ADDR:443" \
    token_reviewer_jwt="$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)" \
    kubernetes_ca_cert=@/var/run/secrets/kubernetes.io/serviceaccount/ca.crt

# Create role
vault write auth/kubernetes/role/myapp \
    bound_service_account_names=myapp-sa \
    bound_service_account_namespaces=production \
    policies=myapp-policy \
    ttl=1h

3.5 Vault Policy

# myapp-policy.hcl
path "secret/data/myapp/*" {
  capabilities = ["read"]
}

path "database/creds/myapp-db" {
  capabilities = ["read"]
}

3.6 Vault Agent Injector

apiVersion: v1
kind: Pod
metadata:
  annotations:
    vault.hashicorp.com/agent-inject: "true"
    vault.hashicorp.com/role: "myapp"
    vault.hashicorp.com/agent-inject-secret-config.json: "secret/data/myapp/config"
    vault.hashicorp.com/agent-inject-template-config.json: |
      {{- with secret "secret/data/myapp/config" -}}
      {
        "api_key": "{{ .Data.data.api_key }}",
        "db_password": "{{ .Data.data.db_password }}"
      }
      {{- end -}}
spec:
  serviceAccountName: myapp-sa
  containers:
    - name: app
      image: myapp:latest

---

4 - AWS Secrets Manager

4.1 CLI

# Create secret
aws secretsmanager create-secret \
    --name myapp/production/db \
    --secret-string '{"username":"admin","password":"secure123"}'

# Get secret
aws secretsmanager get-secret-value \
    --secret-id myapp/production/db

# Rotate secret
aws secretsmanager rotate-secret \
    --secret-id myapp/production/db

4.2 Terraform

resource "aws_secretsmanager_secret" "db" {
  name = "myapp/production/db"
  
  tags = {
    Environment = "production"
  }
}

resource "aws_secretsmanager_secret_version" "db" {
  secret_id     = aws_secretsmanager_secret.db.id
  secret_string = jsonencode({
    username = "admin"
    password = random_password.db.result
  })
}

# Rotation Lambda
resource "aws_secretsmanager_secret_rotation" "db" {
  secret_id           = aws_secretsmanager_secret.db.id
  rotation_lambda_arn = aws_lambda_function.rotate.arn
  
  rotation_rules {
    automatically_after_days = 30
  }
}

4.3 Application Usage

import boto3
import json

def get_secret(secret_name):
    client = boto3.client('secretsmanager')
    response = client.get_secret_value(SecretId=secret_name)
    return json.loads(response['SecretString'])

# Usage
db_creds = get_secret('myapp/production/db')
connection = psycopg2.connect(
    host='db.example.com',
    user=db_creds['username'],
    password=db_creds['password']
)

---

5 - External Secrets Operator

5.1 Installation

helm repo add external-secrets https://charts.external-secrets.io
helm install external-secrets external-secrets/external-secrets

5.2 Configuration AWS

apiVersion: external-secrets.io/v1beta1
kind: ClusterSecretStore
metadata:
  name: aws-secrets-manager
spec:
  provider:
    aws:
      service: SecretsManager
      region: eu-west-1
      auth:
        jwt:
          serviceAccountRef:
            name: external-secrets-sa
---
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: myapp-secrets
  namespace: production
spec:
  refreshInterval: 1h
  secretStoreRef:
    name: aws-secrets-manager
    kind: ClusterSecretStore
  target:
    name: myapp-secrets
    creationPolicy: Owner
  data:
    - secretKey: db-password
      remoteRef:
        key: myapp/production/db
        property: password

5.3 Configuration Vault

apiVersion: external-secrets.io/v1beta1
kind: ClusterSecretStore
metadata:
  name: vault
spec:
  provider:
    vault:
      server: "https://vault.example.com"
      path: "secret"
      version: "v2"
      auth:
        kubernetes:
          mountPath: "kubernetes"
          role: "external-secrets"

---

6 - Rotation automatique

6.1 Stratégie de rotation

rotation_policy:
  credentials:
    frequency: 30 days
    method: automatic
    notification: 7 days before
    
  certificates:
    frequency: 90 days
    method: automated renewal
    
  api_keys:
    frequency: 90 days
    method: graceful rotation (overlap period)

6.2 Zero-downtime rotation

---

Résumé

Dans ce chapitre, nous avons appris :

• Les types de secrets et anti-patterns
• La détection des secrets (GitLeaks, TruffleHog)
• HashiCorp Vault configuration complète
• AWS Secrets Manager
• External Secrets Operator
• La rotation automatique

---

Prochaine étape

Dans le prochain chapitre, nous verrons Compliance as Code.

→ Chapitre suivant : Compliance as Code

---

← Retour à la table des matières