trousseau

We initially looked around, and here are a few alternatives: - Azure Key Vault: https://azure.microsoft.com/en-us/services/key-vault/ - Blackbox: https://github.com/StackExchange/blackbox - CredStash: https://github.com/fugue/credstash - Lyft Confydant: https://github.com/lyft/confidant - Trousseau: https://github.com/oleiade/trousseau - Sneaker: https://github.com/codahale/sneaker Some of these didn't exist when we were first investigating proper secret management, while others didn't fit as well with our deployment strategy. We're using what works when it makes sense - Blackbox is used in some repos, for instance - but I'll be sure the next time we have an internal doc like this that we cover why we didn't choose a different set of tools. One thing we liked about Vault is that it built upon our usage of Consul a

We also wanted things to be simple & wrote a custom cli and ansible module to wrap around https://github.com/oleiade/trousseau, but have slowly found the need for more of the features that tools like these provide. We're planning on switching to Vault or something similar in the near future & will be testing out both of these. I definitely agree with the "backend" confusion surrounding Vault but I'm interested in where Confidant may be lacking. We host services on AWS and Heroku, so in some places AWS' KMS may not be the best option. Regardless, I do have to say it's so refreshing to see security tools with decent documentation & a clean user experience. I'm almost stunned to see a swiftype search box, one page threat model description & preconfigured turn-key container all in one place. Props to Lyft for opening up a great tool to th

Trousseau is a gpg encrypted key-value store designed to be a simple, safe and relient place for your data. It stores data in a single multi-recipients encrypted file and can supports both local and remote storage sources (S3 and ssh so far) import/export. Create a trousseau store, specify which gpg recipients are allowed to open and modify it, and adding some key-value pairs to, export it to s3 for example, and re-import it on another device. As simple as that. Whether you're a devops, a paranoid guy living in a bunker, or the random user who seek a simple way to store it's critical data in safe maneer. Trousseau can do something for you.