Secrets Management（機密管理）

// ASP.NET Core — 使用 Azure Key Vault
using Azure.Identity;
using Azure.Security.KeyVault.Secrets;
 
var builder = WebApplication.CreateBuilder(args);
 
// 從 Azure Key Vault 載入 secrets
builder.Configuration.AddAzureKeyVault(
    new Uri("https://my-vault.vault.azure.net/"),
    new DefaultAzureCredential()
);
 
// 使用時直接從 Configuration 取得
var dbConnection = builder.Configuration["DatabaseConnection"];
 
// 絕對不要這樣做
// var apiKey = "sk-hardcoded-key-12345"; // 硬編碼
 
// HashiCorp Vault 整合
using VaultSharp;
 
var vaultClient = new VaultClient(new VaultClientSettings(
    "https://vault.mycompany.com",
    new TokenAuthMethodInfo("hvs.token")
));
 
var secret = await vaultClient.V1.Secrets.KeyValue.V2
    .ReadSecretAsync("myapp/database");
var password = secret.Data.Data["password"].ToString();

import { SecretManagerServiceClient } from "@google-cloud/secret-manager";
 
// Google Cloud Secret Manager
const client = new SecretManagerServiceClient();
 
async function getSecret(secretName: string): Promise<string> {
  const [version] = await client.accessSecretVersion({
    name: `projects/my-project/secrets/${secretName}/versions/latest`,
  });
  return version.payload?.data?.toString() ?? "";
}
 
// 應用啟動時載入所有需要的 secrets
async function loadSecrets() {
  const dbPassword = await getSecret("db-password");
  const apiKey = await getSecret("external-api-key");
 
  return {
    database: { password: dbPassword },
    externalApi: { key: apiKey },
  };
}
 
// .env 只用於本地開發，搭配 .gitignore
// .env 檔案內容：
// DB_PASSWORD=local-dev-password
// API_KEY=test-key-not-real

import boto3
import json
from functools import lru_cache
 
# AWS Secrets Manager
def get_secret(secret_name: str) -> dict:
    client = boto3.client("secretsmanager", region_name="ap-northeast-1")
    response = client.get_secret_value(SecretId=secret_name)
    return json.loads(response["SecretString"])
 
# 快取 secret，避免每次請求都呼叫 API
@lru_cache(maxsize=32)
def get_db_credentials() -> dict:
    return get_secret("myapp/database")
 
# HashiCorp Vault
import hvac
 
client = hvac.Client(url="https://vault.mycompany.com",
                     token="hvs.token")
 
# 讀取 KV secret
secret = client.secrets.kv.v2.read_secret_version(
    path="myapp/database"
)
db_password = secret["data"]["data"]["password"]
 
# 動態 Secret — 用完即棄的資料庫憑證
creds = client.secrets.database.generate_credentials(
    name="myapp-readonly"
)
temp_username = creds["data"]["username"]
temp_password = creds["data"]["password"]
# 這組憑證會在 TTL 到期後自動失效