Edit - Stack Overflow

You are not logged in. Your edit will be placed in a queue until it is peer reviewed.

We welcome edits that make the post easier to understand and more valuable for readers. Because community members review edits, please try to make the post substantially better than how you found it, for example, by fixing grammar or adding additional resources and hyperlinks.

That sounds true~ish. If you're providing the KMS key to an outsourced dev, and the KMS key can be used to obtain the DB password, what's to stop the outsourced dev from simply using the KMS key and console.logging() the DB password?

AJB
– AJB

2016-12-17 02:44:58 +00:00
Commented Dec 17, 2016 at 2:44
You do not give the outsourced developer the right to run code in a production environment. They can only run code in a dev or staging environment (that uses other passwords). If you take their code and run it in production, then you do not need to modify it at all because the actual credentials are "injected" and decrypted via KMS.

Digitalkapitaen
– Digitalkapitaen

2016-12-17 07:08:08 +00:00
Commented Dec 17, 2016 at 7:08
@Digitalkapitaen I don't get it still. Your point is related to just using different env vars in production. It has nothing to do with encryption. The question that why you encrypt in the first place if in the code the encrypted will be decrypted by the key you provided, still remains.

Arbitrary
– Arbitrary

2021-04-22 07:10:37 +00:00
Commented Apr 22, 2021 at 7:10
@Arbitrary Because one should encrypt everything, especially if it is at rest. Specifically: Encrypting credentials and only decrypting them when they are actually used is good practice to limit the attack surface as much as possible.

Digitalkapitaen
– Digitalkapitaen

2021-04-23 09:32:24 +00:00
Commented Apr 23, 2021 at 9:32

Add a comment |

Correct minor typos or mistakes
Clarify meaning without changing it
Add related resources or links
Always respect the author’s intent
Don’t use edits to reply to the author

create code fences with backticks ` or tildes ~
```
like so
```
add language identifier to highlight code
```python
def function(foo):
print(foo)
```
put returns between paragraphs
for linebreak add 2 spaces at end
_italic_ or **bold**
indent code by 4 spaces
backtick escapes `like _so_`
quote by placing > at start of line
to make links (use https whenever possible)

<https://example.com>

[example](https://example.com)

<a href="https://example.com">example</a>

formatting help »
answering help »

Collectives™ on Stack Overflow