Cloud Secrets Rotation Using Dual Credentials for Zero Downtime
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems face challenges in efficiently and automatically rotating secrets, such as passwords and private SSH keys, across both central storage and target systems, particularly in cloud-based infrastructure, due to stringent security requirements that necessitate frequent rotation.
Innovation Solution
A cloud-based automated secrets rotation system that utilizes an API or functions-based approach to rotate secrets at both centralized storage and target systems, employing dual account rotation to ensure seamless transitions and minimize downtime.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If secrets are rotated frequently to meet security requirements, then security compliance is improved, but system availability and operational continuity deteriorate due to manual intervention requirements and potential downtime
Solution Approach 1:
The system performs preliminary actions by creating a new secret version and validating it before switching. The new secret is generated, tested against the target system, and confirmed working before the old secret is deactivated, ensuring no downtime occurs during rotation
Solution Approach 2:
The system uses an intermediary validation mechanism that tests the new secret against the target system before making it active. This intermediary step ensures the new secret works correctly without disrupting service, bridging the gap between security rotation and availability
2Productivity
If automated rotation functions are implemented, then operational efficiency is improved, but system complexity increases due to integration requirements with target systems
Solution Approach 1:
The system implements universal rotation capabilities that work with multiple target system types (databases, cloud services, applications) through standardized interfaces. The rotation mechanism handles different secret types and system protocols through a unified approach, reducing integration complexity
3Productivity
If dual account rotation is used to maintain continuity, then system availability is improved, but credential management complexity increases
Solution Approach 1:
The system segments credential management by maintaining multiple secret versions (current and pending) within the secret store. Each version is independently managed and validated, allowing seamless switching without complex multi-account coordination
Solution Approach 2:
The system creates a copy of the current secret as a pending version, validates it, and switches between versions. This copying approach simplifies management compared to dual account systems, as it operates within a single secret store using version copies rather than separate accounts
Data Source
AI summary
Embodiments are directed to a cloud based rotation of a secret stored in a secrets storage and stored in a target system. Embodiments receive an identifier of a function for rotating the secret or an identifier of the target system when the target system includes a management Application Programming Interface (“API”) for rotating the secret. Embodiments determine that the secret needs to be rotated based on a rotating schedule. When the identifier of the function is received, embodiments rotate the secret using the function and when the identifier of the target system is received, embodiments rotate the secret using the management API. Rotating the secret includes updating the secret at the secret storage and at the target system.