Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[lambda][flare] Obfuscate secrets #947

Conversation

nhulston
Copy link
Contributor

@nhulston nhulston commented Jun 29, 2023

What and why?

For more context on what Lambda Flare is, please read the description in this PR: #924

We want to obfuscate secrets (passwords, API keys, and other unknown environment variables) in Lambda function configuration so customers don't send private information to Datadog support. Any non-Datadog environment variables should also be obfuscated.

How?

  1. Create a whitelist of 'allowed' environment variables to not be obfuscated. These are stored in a set in the constant NON_OBFUSCATED_ENV_VARS for O(1) lookup.
  2. If an environment variable is not in this set, we will pass it to the getObfuscation function which returns an obfuscated version of the string.
  3. Short strings (<12 characters) will be entirely obfuscated and replaced with *'s. Longer strings will preserve the first 2 and last 4 characters of the string, but obfuscate everything in between.
  4. Numbers and boolean values are unlikely to be secrets, so they can be skipped and returned as-is
  5. Obfuscate the function config before logging to console, saving the file, and sending to Datadog support

Review checklist

  • Feature or bugfix MUST have appropriate tests (unit, integration)

@nhulston nhulston changed the base branch from master to serverless-flare June 29, 2023 20:37
@nhulston nhulston marked this pull request as ready for review June 29, 2023 20:47
@nhulston nhulston requested a review from a team as a code owner June 29, 2023 20:47
@datadog-datadog-prod-us1
Copy link

datadog-datadog-prod-us1 bot commented Jun 29, 2023

Datadog Report

Branch report: nicholas.hulston/serverless-flare/obfuscate-secret-values
Commit report: 51cf701

datadog-ci-tests: 0 Failed, 0 New Flaky, 837 Passed, 0 Skipped, 46.81s Wall Time

@nhulston nhulston marked this pull request as draft June 29, 2023 20:52
@nhulston nhulston removed the request for review from a team June 30, 2023 17:35
@nhulston nhulston force-pushed the nicholas.hulston/serverless-flare/obfuscate-secret-values branch from aa0039d to 5028cc5 Compare June 30, 2023 17:44
@nhulston nhulston marked this pull request as ready for review June 30, 2023 18:25
@nhulston nhulston requested a review from duncanista June 30, 2023 18:49
@nhulston nhulston requested a review from duncanista July 3, 2023 13:26
@nhulston nhulston requested a review from duncanista July 3, 2023 16:54
@nhulston nhulston merged commit 9bddc95 into serverless-flare Jul 3, 2023
@nhulston nhulston deleted the nicholas.hulston/serverless-flare/obfuscate-secret-values branch July 3, 2023 18:19
@duncanista duncanista mentioned this pull request Jul 12, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants