I am currently storing all of my API/library secret access keys in web.config, and the accessing them in code by using:
private static string AWSaccessKey = System.Web.Configuration.WebConfigurationManager.AppSettings["AWSaccessKey"];
private static string AWSprivateKey = System.Web.Configuration.WebConfigurationManager.AppSettings["AWSprivateKey"];
I thought this was recommended, instead of directly hard-coding passwords and access keys. Although I just received an email from AWS telling me that my AWS access key is compromised. I then looked through my Git repo and found that my web.config file is fully available to view; I had thought that this file would not be included in my Git repo.
Can anyone please advise on how I can securely fix this situation? Should I add web.config to a Git ignore file? If I do this, will my application still have access to the access keys in web.config when it is deployed from a pipeline using my Git repo?
file
attribute to put settings outside the project folder.You can store data such as passwords, database strings, EC2 instance IDs, Amazon Machine Image (AMI) IDs, and license codes as parameter values. You can store values as plain text or encrypted data. You can reference Systems Manager parameters in your scripts, commands, SSM documents, and configuration and automation workflows by using the unique name that you specified when you created the parameter.