1

I am currently storing all of my API/library secret access keys in web.config, and the accessing them in code by using:

private static string AWSaccessKey = System.Web.Configuration.WebConfigurationManager.AppSettings["AWSaccessKey"];
private static string AWSprivateKey = System.Web.Configuration.WebConfigurationManager.AppSettings["AWSprivateKey"];

I thought this was recommended, instead of directly hard-coding passwords and access keys. Although I just received an email from AWS telling me that my AWS access key is compromised. I then looked through my Git repo and found that my web.config file is fully available to view; I had thought that this file would not be included in my Git repo.

Can anyone please advise on how I can securely fix this situation? Should I add web.config to a Git ignore file? If I do this, will my application still have access to the access keys in web.config when it is deployed from a pipeline using my Git repo?

3
  • 1
    Perhaps this will help (johnatten.com/2014/04/06/…) Apr 24, 2020 at 15:34
  • 1
    I'm not familiar with AWS but I would expect any pipeline to have the capability to transform config files so you can store the secrets in the pipeline,not in the code. Options for debug values include putting settings in machine.config instead or using the appSettings file attribute to put settings outside the project folder.
    – Crowcoder
    Apr 24, 2020 at 15:36
  • 1
    you may try parameter store and use it in your deployment pipeline. You can store data such as passwords, database strings, EC2 instance IDs, Amazon Machine Image (AMI) IDs, and license codes as parameter values. You can store values as plain text or encrypted data. You can reference Systems Manager parameters in your scripts, commands, SSM documents, and configuration and automation workflows by using the unique name that you specified when you created the parameter.
    – Ersoy
    Apr 24, 2020 at 18:24

2 Answers 2

7

Before you do anything else, deactivate the compromised API key.
Then search through your repository for any other API keys, connection strings, etc, and deactivate them as well.
Even if you remove the key from your code and push, it's still in the repository's history.


It's best to keep your API keys and other secure information out of the code base completely.

My personal preference is to store them in encrypted environment variables on the deployment environment itself.
This approach also has the added benefit of preventing you from accidentally deploying the Prod API Key to the QA environment (or vice a versa).

Another common approach is use a build pipeline and have that pipeline add the secure value to the code's config files at build time.

2
  • Thanks a lot Merkle. I am now using environment variables on my local machine and also hosted VMs. Is this best practice for storing all API keys and db connection strings etc?
    – craig19
    Apr 24, 2020 at 16:46
  • 1
    I've yet to hear a perfect solution for securely maintaining API keys. Make sure your hard drive is encrypted and that no one else has your password. If the API has an option for IP Address limiting, enable it. Apr 24, 2020 at 20:28
0

You an have your secret config values in an external file that is not checked in to your repository.

If you are using Azure you can automate the process of the deployment and fill in the secret values while doing the deployment. Please check this for more details

There is also a mix option between EnvironmentVariables & Webconfig keys please check that also

Your Answer

Reminder: Answers generated by Artificial Intelligence tools are not allowed on Stack Overflow. Learn more

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.