Should Conjure Handle Secrets?

[Josh-Tracy]

Should Conjure Handle Secrets?

When Would a Secret be Provided / Used with Conjure?

1. In interactive mode - This is a non-issue because its not stored anywhere except in the final configuration output. Conjure is not in the business of encrypting outputted artifacts.
2. When --var flag is provided. This is a non-issue because in this scenario the input comes from an external source. This means that if a secret were provided it would come from an output of a previous function in a workflow that retrieved it from a secure location and passed it as a --var via an env var or some other method.
3. When the -f or --values flags are used. This would only be an issue if the values file contains a secret and is stored in plain text. Securing data at rest is not Conjure's responsibility. A values file could be stored without sensitive information and the --var flag could be combined with the -f flag to provide the secret at runtime. This secret would most likely come from an output of a previous step or function in a workflow the same way described in (2).

So it would seem that most workflows would be retrieving a secret from an external location such as Vault or GitHub secrets and passing them in as env vars in workflows and that this is a non-issue for interactive use.

Conjure COULD retrieve a secret at runtime from an external source such as AWS Secrets, Vault, etc. if we implemented such a feature. Users could define a special identifier in a field that informs conjure that a specific variable should come from an external secrets manager. At runtime Conjure would reach out to this secrets manager. The secrets manager connection information would be provided via the conjure configuration file.