<p>Totally stack dependent but as mentioned HashiCorp Vault will provide audit logs, and the other I am familiar with is AWS Parameter Store and Secrets Manager which will provide logs to CloudTrail. The AWS approach is a great one for those already using AWS and looking for an easy barrier to entry. Vault is more powerful but with that comes more complexity to install, run, and maintain (the open-source version at least.. enterprise is awesome but pricey last time a company i work for inquired). The worst thing you can do in my opinion is try to write your own tool for this. Whatever tool you decide on, or if you try to write it, logging is an absolute must</p>

CC BY-SA 4.0
2018-07-18T01:19:12.790Z
2018-07-18T01:19:12.790Z
TechDawg270
<p>The short answer: you would need to use a secret management system that provides 'audit logs'.</p>

<p>There are many options for handling secrets out there, but unless the tool you use has audit logging, you'll never truly know for sure what credential was used where.</p>

<p>I see you mentioned using Hashicorp's Vault. That's a really good one. They have audit logging built in; they call it <a href="https://www.vaultproject.io/docs/audit/index.html" rel="nofollow noreferrer">'Audit Devices'</a>, which can be enabled with a simple command.</p>

<p>Again, there are many perfectly valid options for <em>handling</em> secrets: Chef vault, 1password, environment variables injected by your build instances, home-grown solution using encrypted files stored on object storage, etc.... However, unless the system specifically says it provides audit logging, you'll never truly know what was used when and where.</p>

<p>You can design a secrets system with the best intentions, and make many rules that employees have to follow in regards to have the secrets are accessed, but for auditing purposes, you want to know <em>where</em> the rules have been broken. If you have a firm requirement to always know when and where secrets where used, I recommend you stick with something like Hashicorp Vault, turn on Audit Devices, and then ship the log somewhere for storage or processing.</p>

CC BY-SA 3.0
2018-03-19T14:53:08.653Z
2018-03-19T14:53:08.653Z
BoomShadow
<p>The context of the question is <a href="https://devops.stackexchange.com/questions/3658/secrets-management">Secrets management</a>.</p>

<p>As the title says, how do you know which secrets and credentials of your production services were used, and by whom/what?</p>

CC BY-SA 3.0
2018-03-18T15:59:35.973Z
What did you try?
030
CC BY-SA 3.0
2018-03-19T08:12:45.867Z
@030, I've tried out Hashicorp's Vault and recently tried AWS Parameter store.
Zvika Nadav
CC BY-SA 3.0
2018-03-21T17:59:15.043Z
It depends on your stack.
James Shewey
<amazon-web-services><security><microservices><encryption>
How do you know which secrets and credentials of your production services were used, and by whom/what?
Zvika Nadav
# How do you know which secrets and credentials of your production services were used, and by whom/what?

(Asked by: username_0 on 2018-03-18)

The context of the question is [Secrets management](https://devops.stackexchange.com/questions/3658/secrets-management).

As the title says, how do you know which secrets and credentials of your production services were used, and by whom/what?

**Tags:** amazon-web-services, security, microservices, encryption

> **Comments:**
> **username_1**: What did you try?  
> **username_0**: @username_1, I've tried out Hashicorp's Vault and recently tried AWS Parameter store.  
> **username_2**: It depends on your stack.  

---

## 2 answers

### Answer by username_4 on 2018-03-19. Score: 1

The short answer: you would need to use a secret management system that provides 'audit logs'.

There are many options for handling secrets out there, but unless the tool you use has audit logging, you'll never truly know for sure what credential was used where.

I see you mentioned using Hashicorp's Vault. That's a really good one. They have audit logging built in; they call it ['Audit Devices'](https://www.vaultproject.io/docs/audit/index.html), which can be enabled with a simple command.

Again, there are many perfectly valid options for *handling* secrets: Chef vault, 1password, environment variables injected by your build instances, home-grown solution using encrypted files stored on object storage, etc.... However, unless the system specifically says it provides audit logging, you'll never truly know what was used when and where.

You can design a secrets system with the best intentions, and make many rules that employees have to follow in regards to have the secrets are accessed, but for auditing purposes, you want to know *where* the rules have been broken. If you have a firm requirement to always know when and where secrets where used, I recommend you stick with something like Hashicorp Vault, turn on Audit Devices, and then ship the log somewhere for storage or processing.


---

### Answer by username_3 on 2018-07-18. Score: 0

Totally stack dependent but as mentioned HashiCorp Vault will provide audit logs, and the other I am familiar with is AWS Parameter Store and Secrets Manager which will provide logs to CloudTrail. The AWS approach is a great one for those already using AWS and looking for an easy barrier to entry. Vault is more powerful but with that comes more complexity to install, run, and maintain (the open-source version at least.. enterprise is awesome but pricey last time a company i work for inquired). The worst thing you can do in my opinion is try to write your own tool for this. Whatever tool you decide on, or if you try to write it, logging is an absolute must


---

