View Source SecretAgent (Secret Agent v0.8.1)

This module provides the possibility to manage secrets and to watch for directory changes.

It's aimed at managing secrets rotation (typically credentials written by Vault). Thus, it wraps secrets in closures to avoid leaking and use a constant-time comparison function to mitigate timing attacks.

https://erlef.github.io/security-wg/secure_coding_and_deployment_hardening/sensitive_data https://erlef.github.io/security-wg/secure_coding_and_deployment_hardening/timing_attacks

Link to this section Summary

Functions

Returns a specification to start this module under a supervisor.

Set the secret value of secret_name to :erased.

Return the secret value (a closure or :erased) corresponding to secret_name.

Set the secret value (wrapped in a closure) of secret_name.

Start secret_agent as a linked process.

Link to this section Functions

Returns a specification to start this module under a supervisor.

See Supervisor.

Link to this function

erase_secret(server, secret_name)

View Source
@spec erase_secret(pid() | atom(), binary()) :: :ok

Set the secret value of secret_name to :erased.

If secret_name does not exist, nothing happen.

Link to this function

get_secret(server, secret_name, opts \\ [erase: true])

View Source
@spec get_secret(pid() | atom(), binary(), Keyword.t()) ::
  {:ok, function() | :erased} | {:error, term()}

Return the secret value (a closure or :erased) corresponding to secret_name.

As a best practice, the secret will be erased (as if called by erase_secret/2). You can override this behavior with the option erase: false.

Link to this function

put_secret(server, secret_name, wrapped_secret)

View Source
@spec put_secret(pid() | atom(), binary(), function()) :: :ok

Set the secret value (wrapped in a closure) of secret_name.

If secret_name does not exist, it's added to existing secrets.

Start secret_agent as a linked process.