安全机密管理与环境变量

硬编码 Secret 问题

# DANGEROUS: hardcoded secret in source code
# db_password = 'P@ssw0rd#2026'
# api_key = 'sk-live-abc123xyz789'
# aws_secret = 'wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY'

# These secrets are now:
# - In git history (even if later deleted)
# - Visible to all repo contributors
# - Potentially in CI/CD logs
# - Often leaked when repos go public accidentally

环境变量：更好，但仍然不够

# Environment variable pattern:
# In .env file (NEVER commit to git):
# DB_PASSWORD=P@ssw0rd#2026
# API_KEY=sk-live-abc123xyz789

# In .gitignore:
# .env
# *.env
# .env.*

# In application code:
# db_password = os.environ.get('DB_PASSWORD')
# api_key = os.environ.get('API_KEY')

# Risk: env vars visible in 'ps aux' output,
# inherited by child processes, appear in /proc/<pid>/environ

专用 Secret 管理器

# HashiCorp Vault secret retrieval (conceptual):
# Application authenticates to Vault using:
#   - AWS IAM role (in cloud environments)
#   - Kubernetes service account token
#   - AppRole credentials

# After authentication, retrieve secret:
# vault kv get -field=password secret/prod/database

# In application (Python SDK):
# client = hvac.Client(url='https://vault.company.com')
# client.auth.aws.iam_login(role='prod-app')
# secret = client.secrets.kv.read_secret('prod/database')
# db_password = secret['data']['password']

自动 Secret 轮换

# AWS Secrets Manager rotation configuration:
# Secret:         prod/app-database-credentials
# Rotation:       enabled
# Frequency:      every 30 days
# Lambda function: SecretsManager-MyRDSRotation

# Rotation process:
# 1. Lambda creates new DB password
# 2. Updates secret in Secrets Manager
# 3. Updates password on RDS instance
# 4. Tests new credentials work
# 5. Deprecates old credentials
# Application: always calls GetSecretValue at runtime -> gets fresh value

The .gitignore 防御

# Recommended .gitignore entries for secret files:
# .env
# .env.*
# *.pem
# *.key
# *.p12
# *.pfx
# credentials.json
# service_account*.json
# secrets.yaml
# config/secrets.yml
# terraform.tfvars  (may contain cloud credentials)
# .aws/credentials

# Pre-commit hook to scan for secrets before commit:
# pre-commit install
# hook: detect-secrets / gitleaks / truffleHog

基础设施即代码中的密钥

密钥的最小权限原则

# Vault policy: web application can read DB password only
# policy name: web-app-policy
# path 'secret/prod/database' {
#   capabilities = ['read']
# }
# path 'secret/prod/tls-certs/*' {
#   capabilities = []  # DENY - app does not need TLS keys
# }

# This policy is assigned to the web app's AppRole.
# The reporting service gets a separate policy with
# only 'secret/prod/reporting-db-readonly' access.

动态密钥

# Vault dynamic secrets: temporary DB credentials
# Application calls Vault to get a DB credential:
# vault read database/creds/web-app-role
#
# Vault response:
# username: v-web-app-x7k2m-1234567890  (unique, temporary)
# password: A1b2C3d4E5f6G7h8            (randomly generated)
# lease_duration: 1h                     (auto-expires)
#
# After 1 hour, Vault instructs DB to revoke this user.
# No static password ever exists for the attacker to steal.

CI/CD 流水线中的密钥

# GitHub Actions: using secrets in pipeline
# secrets.yml in GitHub Settings -> Secrets (encrypted storage)
# Secret: AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY

# In .github/workflows/deploy.yml:
# env:
#   AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
#   AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}

# Best practice: use OIDC federation instead
# GitHub -> AWS trust relationship via OIDC token
# -> No static AWS keys needed at all

审计密钥访问

用于防止密钥泄露的提交前钩子

# Installing detect-secrets as pre-commit hook:
# 1. Install: pip install detect-secrets
# 2. Create baseline: detect-secrets scan > .secrets.baseline
# 3. Add to .pre-commit-config.yaml:
#    repos:
#      - repo: https://github.com/Yelp/detect-secrets
#        rev: v1.4.0
#        hooks:
#          - id: detect-secrets
#            args: ['--baseline', '.secrets.baseline']
# 4. Install hooks: pre-commit install

# Now every commit attempt is scanned:
# git commit -m 'add config'
# -> detect-secrets runs
# -> if AWS key pattern found: COMMIT BLOCKED
# -> developer must remove secret and use secrets manager

快速检查

课程回顾