SecretsWatcher (Secrets Watcher v0.2.0) View Source

This module provides the possibility to watch for a directory changes and to have callbacks called upon file modification.

It's aimed at managing secrets rotation (typically credentials written by Vault). Thus, it wraps secrets in closures to avoid leaking and use a constant-time comparison function to mitigate timing attacks.

https://erlef.github.io/security-wg/secure_coding_and_deployment_hardening/sensitive_data https://erlef.github.io/security-wg/secure_coding_and_deployment_hardening/timing_attacks

Link to this section Summary

Functions

Returns a specification to start this module under a supervisor.

Return the secret (wrapped in a closure) corresponding to secret_name.

Link to this section Functions

Returns a specification to start this module under a supervisor.

See Supervisor.

Link to this function

get_wrapped_secret(server, secret_name)

View Source

Specs

get_wrapped_secret(pid() | atom(), binary()) ::
  {:ok, function()} | {:error, term()}

Return the secret (wrapped in a closure) corresponding to secret_name.