Skip to main content
Share Your Experience: Take the 2024 Developer Survey
30 votes
Accepted

How can I manage secrets in .tf and .tfstate?

Terraform supports adding an additional file with variables during invocation. documentation: https://www.terraform.io/intro/getting-started/variables.html#from-a-file We are using that feature to ...
Evgeny Zislis's user avatar
24 votes
Accepted

What are best and comprehensive practices to consider when running docker in production?

The host on which the containers are running Run the docker security bench on every node that runs docker containers https://github.com/docker/docker-bench-security Running the following command on ...
030's user avatar
  • 13.2k
18 votes

How to prohibit access to internals of Docker container?

In short, you cannot prevent your customers from modifying containers they run in their own infrastructure. Containers are not like binaries that can be obfuscated; they are runtime environments. ...
Dave Swersky's user avatar
  • 4,068
18 votes
Accepted

What Is SecOps?

I'd agree this is a buzzword as much as DevOps can be. Main task of a SecOps added on top of an usual operational engineer tasks is to take the burden of following CVE publication feeds, handling the ...
Tensibai's user avatar
  • 11.4k
15 votes
Accepted

Where to put ansible-vault password

The idea is to put all our sensitive data [...] The meaning of "all" in this sentence should be analyzed very carefully before implementing the solution that you plan. Ansible vault is a very useful ...
Vincenzo Pii's user avatar
12 votes
Accepted

What are the best practices for anti-virus / anti-malware when using containers?

This is an area where you will need to talk directly to and potentially help educate your auditors. What you have to remember is they are responsible for ensuring that adequate controls are applied, ...
Richard Slater's user avatar
11 votes

How can I manage secrets in .tf and .tfstate?

If you're on AWS, then have a look at "The Right Way to Manage Secrets" by Segment.io on the AWS Blog. We advocate using chamber to all of our customers for managing secrets. It works by leveraging ...
Erik Osterman's user avatar
10 votes

Where to put ansible-vault password

We are planning to use ansible vault in our project to prevent leaking passwords or keys in git. Since you haven't yet implemented anything, you might reconsider this. Using a system like Ansible ...
Xiong Chiamiov's user avatar
9 votes

What Is SecOps?

I do agree with Tensibai's Answer in that SecOps is as much as a buzz-word as DevOps itself and that SecOps is a stepping stone between a siloed organisation and cohesive organisation. I have ...
Richard Slater's user avatar
9 votes

How to prohibit access to internals of Docker container?

Docker doesn't provide any means to preclude user access to the container, however as the image developer you could follow a few strategy Obfuscate your software (ruby, python and etc) Build your ...
Jeeva's user avatar
  • 436
8 votes

What are best and comprehensive practices to consider when running docker in production?

Docker images itself An additional option is to use Clair. Clair is an open source project for the static analysis of vulnerabilities in application containers (currently including appc and ...
030's user avatar
  • 13.2k
8 votes

What are best and comprehensive practices to consider when running docker in production?

In addition to the points in this thread; the following would be my recommendation: Get control over Docker PID1 with dumb-init ref: PID1 and Zombie reaping problem Do not run docker in production ...
Hashfyre's user avatar
  • 441
8 votes

How can I manage secrets in .tf and .tfstate?

We avoid terraform handle our secrets. Even if you manage to inject secrets by a var file "secrtes.tfvars" as pointed out above, these secrets will be stored in your terraform (remote-)state. You can ...
jerger's user avatar
  • 141
8 votes
Accepted

How to store credentials that are required by an application?

Proper management of an application's secrets has always been a challenge. New challenges came with the adoption of the cloud. There's a great OWASP presentation about the reality and challenges of ...
Alexandre's user avatar
  • 1,965
8 votes
Accepted

Does `npm audit` add any value when using `dependabot`

Dependabot and npm audit both poll the Node Security Working Group database for Node-based projects. However, Dependabot has the added ability to check dependencies in numerous other types of projects ...
Adam's user avatar
  • 196
7 votes
Accepted

How to storing encrypted secrets in code for a serverless.com project?

There are a couple of elements to consider here: It is valuable to have the capability to maintain configuration with a separate release cadence from the code that is being configured. Doing so ...
Richard Slater's user avatar
7 votes

What are best and comprehensive practices to consider when running docker in production?

Docker is still in development. As with every other software in-dev bugs will happen, insecure features might be added, there could be architectural flaws that lead to security breaches. Do not ...
TwoThe's user avatar
  • 171
7 votes
Accepted

Running the docker daemon without root

Compared to just adding the user to the docker group the second links solution is not any more secure. Note how that page still can launch with the --privileged flag, and that it is running ...
gdahlm's user avatar
  • 366
7 votes

Is it bad to use sudo from Jenkins?

Whether you allow remote sudo or remote access to something that does SUID root you have a pretty similar attack surface. I would keep sudo in the chain because it lets you limit the commands easily ...
chicks's user avatar
  • 1,848
6 votes

How to prohibit access to internals of Docker container?

If your client is ready to invest money then you should go with Docker enterprise edition. In Docker EE you have one tool that is UCP(Universal Control Plane) UCP. By UCP you can create roles and ...
chintan thakar's user avatar
6 votes
Accepted

How to only allow API Gateway requests to reach our EC2 instances

Since November 2017, it is now possible to directly interact with servers in a VPC \o/ See: https://stackoverflow.com/questions/32671394/can-i-specify-http-endpoint-in-a-vpc-as-resource-in-aws-api-...
Maxime Thoonsen's user avatar
6 votes
Accepted

Is it bad to use sudo from Jenkins?

No, it's actually really good security practice to sudo when you need higher level privileges. This is the reason that most distributions prohibit default login and actually force you to sudo su ...
James Shewey's user avatar
  • 3,734
6 votes
Accepted

From a security perspective, to which location should one copy an app inside a docker image?

I don't see a point. An external attacker (who has access to the host) can easily find where the files are - he only has to look at the last file system layer and will have them presented right there ...
AnoE's user avatar
  • 4,876
5 votes

How to prohibit access to internals of Docker container?

You can remove the users from the docker group and create sudos for the docker start and docker stop.
user2590's user avatar
5 votes

Open Ports on Google Cloud Load Balancer

info from: https://cloud.google.com/load-balancing/docs/https#open_ports Open ports The external HTTP(S) load balancers are reverse proxy load balancers. The load balancer terminates incoming ...
user19467's user avatar
5 votes

Where to put ansible-vault password

This quite much goes to what internal policies you have on handling sensitive data. I'd like to tell you my approach to this and explain what I see as pros and cons. I keep the Ansible Vault ...
13dimitar's user avatar
  • 757
5 votes

How to list security groups for the specific instance via CLI?

The following one-liner in shell works for me: aws ec2 describe-security-groups --group-ids $(aws ec2 describe-instances --instance-id $id --query "Reservations[].Instances[].SecurityGroups[].GroupId[...
kenorb's user avatar
  • 7,881
5 votes
Accepted

When your micro service in production needs a secret, where is the secret stored and retrieved from?

Short answer Ideally, you should store secrets as environment variables, and retrieve them from a secrets management system like Hashicorp's Vault or AWS Parameter store. Long answer I saw your ...
BoomShadow's user avatar
  • 1,472
5 votes
Accepted

Terraform: how do you inspect sensitive data?

When your configuration or a provider marks an attribute as sensitive, Terraform will always hide that value in any output that's intended for human consumption. The real values are available in ...
Martin Atkins's user avatar
4 votes

Open Ports on Google Cloud Load Balancer

It's not currently possible to restrict a GCP load balancer's ports and protocols used like you can with an AWS ELB. This is a feature request. https://issuetracker.google.com/issues/35904903
bootbeast's user avatar
  • 189

Only top scored, non community-wiki answers of a minimum length are eligible