secretes: cloud_provider needs to be specified per data type
adamdecaf opened this issue · 6 comments
Customers Version: master
What were you trying to do?
We have CLOUD_PROVIDER which is used to configure multiple encryption routines
- documents
- account numbers
- etc..
This means they all need to be the same value, but that isn't often the case. We use file for storing account numbers, but want to store documents in Google's cloud storage.
What did you expect to see?
Encryption routines should be configured for each data type. Their use-cases will vary.
How can we resolve this problem
Maybe cloud_provider is the wrong configuration setting. What about defaulting account numbers to file and seeing if document encryption over file is a better option.
@adamdecaf Should we close this issue with #222 ?
I think so. I'm thinking we don't want to share the local encryption key for all data types though. Looks like we're doing that - I missed changing that in the original issue.
- SSN: https://github.com/moov-io/customers/blob/master/cmd/server/main.go#L140
- Documents: https://github.com/moov-io/customers/blob/master/cmd/server/main.go#L179
customers/pkg/secrets/secrets.go
Lines 103 to 106 in 455cd17
Are you thinking the encryption key should be passed into OpenSecretKeeper()? The value would only be used if cloudProvider == local, but it'd make it simple to separate keys by data type..
Yea, I think if people are specifying keys they'd want different one for each type of data. Thoughts?
I'm on board. My only hesitation is the number of env vars available for this service as opposed to a yaml-based (or similarly robust) config scheme. I do think it's a worthwhile change though. Maybe we should look into an improved config for this service in another issue?
Agreed 100% we should use a file based config. I've just been trying to get the configuration implemented so we understand the structure a bit better.