Effective Password Management in Source Code: Secure Solutions with sops and AWS KMS

About the Customer

Our customer specializes in the development of applications for processing sensitive data and places the highest priority on security—particularly in the management of passwords within source code. The customer was seeking efficient and reliable solutions to ensure that sensitive information is protected while maintaining smooth and uninterrupted workflows.

Challenge

The new solution is being developed with a strong focus on serverless services on Amazon Web Services. Users access the web frontend through a centralized user management system provided by AWS Cognito in combination with single sign-on (SSO) and Azure Active Directory. Deployment is handled using ECS Fargate and Next.js, with content stored in Amazon S3. Lambda functions act as interfaces to external data sources, S3, and the Aurora Serverless RDS database.

Solution

To address this challenge, the customer chose to implement sops (Secrets Operator) in combination with AWS Key Management Service (KMS).
Sops is an open-source tool that simplifies file encryption, while AWS KMS enables secure management of encryption keys.

The process began with the creation of an IAM user and a KMS key within the customer’s existing AWS account. Sops was then installed and configured to work with the KMS key.

Once the user and key were set up, the customer was able to encrypt and decrypt password files. Files containing environment variables (.yaml, .env, .json, etc.) were encrypted using the KMS key and a specified AWS profile, enabling seamless integration across different environments and working profiles.

An example command to encrypt a file is:
Sops -k $SOPS_KMS_ARN –aws-profile myProfile -e -i myFile.env
With this approach, the keys remained readable while the passwords were securely encrypted. This allowed the team to safely store sensitive data within the source code without compromising security.

Benefits for the Customer

The implementation of sops in combination with AWS Key Management Service (KMS) provided several advantages for the customer:

Improved Security

Sensitive information such as passwords is securely encrypted, significantly reducing the risk of unauthorized access.

Seamless Workflow

Thanks to the seamless integration with AWS and the user-friendly handling of sops, the development process was not disrupted. The team was able to work efficiently without having to worry about security concerns.

Flexibility and Scalability

The solution can be easily adapted to different use cases and environments and scales in line with the company’s growing requirements.

Conclusion:

Overall, the successful implementation of sops in conjunction with AWS KMS enabled our client to securely manage sensitive password files in source code. This solution not only enhanced security, but also enabled a smooth workflow and provided remarkable flexibility for different use cases and environments. The successful implementation of these measures illustrates the effectiveness and strategic value that innovative security initiatives bring to software development.