30
votes
Accepted
How can I manage secrets in .tf and .tfstate?
Terraform supports adding an additional file with variables during invocation.
documentation: https://www.terraform.io/intro/getting-started/variables.html#from-a-file
We are using that feature to ...
- 9,003
24
votes
Accepted
What are best and comprehensive practices to consider when running docker in production?
The host on which the containers are running
Run the docker security bench on every node that runs docker containers https://github.com/docker/docker-bench-security
Running the following command on ...
- 13.3k
18
votes
How to prohibit access to internals of Docker container?
In short, you cannot prevent your customers from modifying containers they run in their own infrastructure. Containers are not like binaries that can be obfuscated; they are runtime environments. ...
- 4,068
18
votes
Accepted
What Is SecOps?
I'd agree this is a buzzword as much as DevOps can be.
Main task of a SecOps added on top of an usual operational engineer tasks is to take the burden of following CVE publication feeds, handling the ...
- 11.4k
15
votes
Accepted
Where to put ansible-vault password
The idea is to put all our sensitive data [...]
The meaning of "all" in this sentence should be analyzed very carefully before implementing the solution that you plan.
Ansible vault is a very useful ...
- 381
12
votes
Accepted
What are the best practices for anti-virus / anti-malware when using containers?
This is an area where you will need to talk directly to and potentially help educate your auditors. What you have to remember is they are responsible for ensuring that adequate controls are applied, ...
- 11.7k
11
votes
How can I manage secrets in .tf and .tfstate?
If you're on AWS, then have a look at "The Right Way to Manage Secrets" by Segment.io on the AWS Blog. We advocate using chamber to all of our customers for managing secrets. It works by leveraging ...
- 326
10
votes
Where to put ansible-vault password
We are planning to use ansible vault in our project to prevent leaking passwords or keys in git.
Since you haven't yet implemented anything, you might reconsider this. Using a system like Ansible ...
- 2,841
9
votes
What Is SecOps?
I do agree with Tensibai's Answer in that SecOps is as much as a buzz-word as DevOps itself and that SecOps is a stepping stone between a siloed organisation and cohesive organisation.
I have ...
- 11.7k
9
votes
How to prohibit access to internals of Docker container?
Docker doesn't provide any means to preclude user access to the container, however as the image developer you could follow a few strategy
Obfuscate your software (ruby, python and etc)
Build your ...
- 456
9
votes
Accepted
Does `npm audit` add any value when using `dependabot`
Dependabot and npm audit both poll the Node Security Working Group database for Node-based projects. However, Dependabot has the added ability to check dependencies in numerous other types of projects ...
- 206
8
votes
What are best and comprehensive practices to consider when running docker in production?
Docker images itself
An additional option is to use Clair.
Clair is an open source project for the static analysis of
vulnerabilities in application containers (currently including appc
and ...
- 13.3k
8
votes
What are best and comprehensive practices to consider when running docker in production?
In addition to the points in this thread; the following would be my recommendation:
Get control over Docker PID1 with dumb-init
ref: PID1 and Zombie reaping problem
Do not run docker in production ...
- 441
8
votes
How can I manage secrets in .tf and .tfstate?
We avoid terraform handle our secrets. Even if you manage to inject secrets by a var file "secrtes.tfvars" as pointed out above, these secrets will be stored in your terraform (remote-)state.
You can ...
- 141
8
votes
Accepted
How to store credentials that are required by an application?
Proper management of an application's secrets has always been a challenge. New challenges came with the adoption of the cloud. There's a great OWASP presentation about the reality and challenges of ...
- 1,965
7
votes
Accepted
How to storing encrypted secrets in code for a serverless.com project?
There are a couple of elements to consider here:
It is valuable to have the capability to maintain configuration with a separate release cadence from the code that is being configured. Doing so ...
- 11.7k
7
votes
What are best and comprehensive practices to consider when running docker in production?
Docker is still in development.
As with every other software in-dev bugs will happen, insecure features might be added, there could be architectural flaws that lead to security breaches. Do not ...
- 171
7
votes
Accepted
Running the docker daemon without root
Compared to just adding the user to the docker group the second links solution is not any more secure.
Note how that page still can launch with the --privileged flag, and that it is running ...
- 366
7
votes
Is it bad to use sudo from Jenkins?
Whether you allow remote sudo or remote access to something that does SUID root you have a pretty similar attack surface. I would keep sudo in the chain because it lets you limit the commands easily ...
- 1,893
7
votes
Accepted
Is it bad to use sudo from Jenkins?
No, it's actually really good security practice to sudo when you need higher level privileges. This is the reason that most distributions prohibit default login and actually force you to sudo su ...
- 3,742
6
votes
How to prohibit access to internals of Docker container?
If your client is ready to invest money then you should go with Docker enterprise edition. In Docker EE you have one tool that is UCP(Universal Control Plane) UCP. By UCP you can create roles and ...
- 161
6
votes
Accepted
How to only allow API Gateway requests to reach our EC2 instances
Since November 2017, it is now possible to directly interact with servers in a VPC \o/
See:
https://stackoverflow.com/questions/32671394/can-i-specify-http-endpoint-in-a-vpc-as-resource-in-aws-api-...
6
votes
Accepted
From a security perspective, to which location should one copy an app inside a docker image?
I don't see a point.
An external attacker (who has access to the host) can easily find where the files are - he only has to look at the last file system layer and will have them presented right there ...
- 4,906
5
votes
How to prohibit access to internals of Docker container?
You can remove the users from the docker group and create sudos for the docker start and docker stop.
- 51
5
votes
Open Ports on Google Cloud Load Balancer
info from: https://cloud.google.com/load-balancing/docs/https#open_ports
Open ports
The external HTTP(S) load balancers are reverse proxy load balancers. The load balancer terminates incoming ...
- 51
5
votes
Where to put ansible-vault password
This quite much goes to what internal policies you have on handling sensitive data.
I'd like to tell you my approach to this and explain what I see as pros and cons. I keep the Ansible Vault ...
- 757
5
votes
How to list security groups for the specific instance via CLI?
The following one-liner in shell works for me:
aws ec2 describe-security-groups --group-ids $(aws ec2 describe-instances --instance-id $id --query "Reservations[].Instances[].SecurityGroups[].GroupId[...
- 7,981
5
votes
Accepted
When your micro service in production needs a secret, where is the secret stored and retrieved from?
Short answer
Ideally, you should store secrets as environment variables, and retrieve them from a secrets management system like Hashicorp's Vault or AWS Parameter store.
Long answer
I saw your ...
- 1,472
5
votes
Accepted
Terraform: how do you inspect sensitive data?
When your configuration or a provider marks an attribute as sensitive, Terraform will always hide that value in any output that's intended for human consumption.
The real values are available in ...
- 2,279
4
votes
Open Ports on Google Cloud Load Balancer
It's not currently possible to restrict a GCP load balancer's ports and protocols used like you can with an AWS ELB.
This is a feature request. https://issuetracker.google.com/issues/35904903
- 189
Only top scored, non community-wiki answers of a minimum length are eligible