Securing Your Application Secrets With a Secure Vault
By: Oyetoke Tobi Emmanuel
Tags: DevOps, Technology, Programming, Software Development, Security

How to Store and Access Secrets on AKEYLESS Vault

Like I mentioned earlier, there are various methods you can use to store and access secrets on AKEYLESS vaults and we have been able to set up both the CLI and Python SDK.

One thing I didn’t mention is how you can also manage your secrets using the web dashboard. So we can now manage our application secrets through the web dashboard, CLI, and Python SDK.

Cool, right?

Let’s see how to just do that.

Using the web dashboard

To use the web UI dashboard, you’d need to login to the dashboard. So head over to the login page here and enter your access ID and access key correctly. Once it's successful, it should take you to a dashboard below:

Right from this view, you can see a list of secrets — both their name and types. To create new secrets or keys, simply click on the + New button at the top.

This should show a pop up with a list of types of secrets/keys available. You can click on the one you want to create.

To create a new static secret, click on Static Secret, enter the name, description, the secret value, and the encryption key in case you would like to encrypt it with a custom key.

Then click on Save to create your new secrets.

After successfully creating your application secrets, to access your secrets through the web dashboard, you will need to head to the dashboard and click on the name of the secret/key to open the secret details.

By default, your secret value is encrypted with the default encryption or the one provided by you. You can click on the Decrypt and copy to clipboard to decrypt the value and have it copied in your system clipboard.

That’s all for the web dashboard vault.

Using the vault’s CLI

Now let’s look at how to interface with the AKEYLESS vault using the CLI (command-line interface) application we installed earlier.

It’s quite easy to use this, as the commands are easy to remember. To verify if our CLI is working, you can try running:

$ akeyless -h

akeyless <command> -h, --help

If you get the same message as above, then you are good to go or you can try reinstalling it again.

The first thing we want to do here is to create a secret key using the CLI create-secret command.

To create a secret key, you will need to follow the below create-secret command syntax:

$ akeyless create-secret --name <SecretName> --value "<SecretValue>"

Where:

<SecretName> is the name of your secret. <SecretValue> is the secret key/value.

With this, we can create a new secret key:

$ akeyless create-secret --name AppSecret --value "wiutiJHQ&(Q*&)R*Q7r^Q#"

Then, to get our secret, you will need to use the get-secret-value command structure, as below:

$ akeyless get-secret-value --name <SecretName>

With that, we can run this command to get our secret value:

$ akeyless get-secret-value --name AppSecret

Another cool thing is you can update your secret using the command below:

$ akeyless update-secret-val --name AppSecret --value "new secret value"

Other available commands are: create-dynamic-secret , get-dynamic-secret , create-ssh-cert-issuer , get-ssh-cert-issuer and so on. You can read more here.

Using the Python SDK

So far, we have looked at how to interface with our vaults using the web dashboard and CLI. Now, we’ll be looking at how to do just that with the Python SDK.

Ensure you have followed the Python SDK setup instructions mentioned earlier in order to continue.

We’ll be continuing from where we stopped in our Python SDK setup. Make sure you have this connection code below running:

Like I explained earlier, for every request we will be sending through the Python module, we need to pass along the token as it serves as authentication to be able to access our vaults.

To create a new secret, we’ll be using the create_secret function. Let’s look at the code below:

secret_name = '<secret_name>' # Secret name

secret_value = '<secret_value>' # secret value

secret_metadata = '<secret_metadata>' # Description about the secret (optional)

create_response = api_instance.create_secret(secret_name, secret_value, token, metadata=secret_metadata)

Looking at the code above on line 4, we passed our token to the create_secret function to authenticate our requests. Running this will create a secret with the name provided assigned to the value given.

To access our secret, all we need to do is to pass the token and secret name to the get_secret_value function:

secret_val_res = api_instance.get_secret_value(secret_name, token) print(secret_val_res) # secret value

This should print out our application secrets key.

To update our secret key, we can simply write below:

new_secret_value = "this is a new secret" api_instance.update_secret_val(secret_name, new_secret_value, token) secret_val_res = api_instance.get_secret_value(secret_name, token)

Below are other functions you can call to create different types of secret/keys:

dynamic_secret = api_instance.create_dynamic_secret(name, token, metadata=metadata, key=key) # creates a dynamic secret - can provide `key` for encryption ssh_cert = api_instance.create_ssh_cert_issuer() # create new ssh cert issuer pki_cert = api_instance.create_pki_cert_issuer() # create new ssh cert issuer

You can read more about the available functions here.