View Source SecretAgent (Secret Agent v0.8.0)
This module provides the possibility to manage secrets and to watch for directory changes.
It's aimed at managing secrets rotation (typically credentials written by Vault). Thus, it wraps secrets in closures to avoid leaking and use a constant-time comparison function to mitigate timing attacks.
https://erlef.github.io/security-wg/secure_coding_and_deployment_hardening/sensitive_data https://erlef.github.io/security-wg/secure_coding_and_deployment_hardening/timing_attacks
Link to this section Summary
Functions
Returns a specification to start this module under a supervisor.
Set the secret value of secret_name
to :erased
.
Return the secret value (a closure or :erased
) corresponding to secret_name
.
Set the secret value (wrapped in a closure) of secret_name
.
Start secret_agent
as a linked process.
Link to this section Functions
Returns a specification to start this module under a supervisor.
See Supervisor
.
Set the secret value of secret_name
to :erased
.
If secret_name
does not exist, nothing happen.
@spec get_secret(pid() | atom(), binary(), Keyword.t()) :: {:ok, function() | :erased} | {:error, term()}
Return the secret value (a closure or :erased
) corresponding to secret_name
.
As a best practice, the secret will be erased (as if called by erase_secret/2
).
You can override this behavior with the option erase: false
.
Set the secret value (wrapped in a closure) of secret_name
.
If secret_name
does not exist, it's added to existing secrets.
Start secret_agent
as a linked process.