Robo Orders Pizza

Scene 3 · Keeping secrets out of sight

The locked box

To order pizza, Robo has to log in to the pizza shop's website. That means Robo needs a password, and a password is only useful while it stays secret.

Go a level deeper ↓

1 The password on the instruction card

This is how Robo was first set up: the password is written right into its instructions.

Robo's instructions

  1. Open the pizza shop's website
  2. Log in as maple-hill-party, password pepperoni-42
  3. Order 6 large, half cheese

Instructions get copied, shared, and posted. Anything written in them is no longer secret.

A password written into the instructions is a hard-coded secret, and it is a common way secrets leak.

2 Who may open the box?

The box keeps the password scrambled. Only the key keeper can unscramble it, and only for someone on the list.

The listRobo may open pizza-shop-login. Nobody else.access policy
Key keeperHolds the unscramble key, kept apart from the box.encryption key

Who's asking?

Logbook audit log

  1. No one has asked yet.

3 Change the combination

Passwords should change now and then, and right away if one leaks. Robo orders a pizza every couple of seconds. Change the password and keep the orders going.

Robo's orders
  1. Make a new combinationstored next to the old one, labelled "pending"createSecret
  2. Set it at the pizza shopsetSecret
  3. Try it oncetestSecret
  4. Flip the labelsnew becomes "current", old is kept as "previous"finishSecret
v1 current

Pick a way to change it.

What you just used

Locked boxsecrets manager, or vault
Password on the cardhard-coded secret
Scrambled insideencryption at rest
Key keeperkey management service
The listaccess policy
Logbookaudit log
Asking before each orderfetching the secret at runtime
Changing the combinationrotation
"Current" and "previous"version labels

Who builds locked boxes

  • Run your own with open-source OpenBao, or HashiCorp Vault.
  • Built into each cloud: AWS Secrets Manager, Google Cloud Secret Manager, Azure Key Vault.
  • Made for developer teams, across clouds and laptops: Doppler and others.
Connects to
  • Is that badge real?: the box decides whether to open; the badge proves who is asking.
  • Robo gets a job: the agent desk keeps its own keys for outside services in a box like this one.
  • Underneath both: a separate key keeper, so the box's contents stay scrambled even to the box.
Peek at a real locked box

This scene, for real, in AWS Secrets Manager: a box created, two names checked against the list by AWS's own policy evaluator, the combination changed, and everything deleted afterwards. The password was random and only its first letter is shown.

# 1. Put the pizza shop's password in the box
$ aws secretsmanager create-secret --name robo-pizza/pizza-shop-login
   ARN: arn:aws:secretsmanager:us-east-1:<account>:secret:robo-pizza/pizza-shop-login-<id>
   Encrypted with: aws/secretsmanager (AWS managed key)

# 2. The list: Robo may open the box, the hall monitor may not
   Robo          GetSecretValue on the box -> allowed
   Hall monitor  GetSecretValue on the box -> implicitDeny
   (evaluated by IAM's policy simulator; anything not explicitly allowed is denied)

# 3. Ask the box at the moment the password is needed
$ aws secretsmanager get-secret-value --secret-id robo-pizza/pizza-shop-login
   password: _•••••••••••••••   version stages: ['AWSCURRENT']

# 4. Change the combination
   version 2eecbe77…  AWSPREVIOUS
   version 3c9d74c9…  AWSCURRENT
   Robo's next ask gets: c•••••••••••••••  (the new one: True)

# 5. Clean up
   deleted robo-pizza/pizza-shop-login and roles robo-pizza-robo, robo-pizza-hall-monitor

Run it yourself: lab/locked_box.py.

Go a level deeper

The locked box at scale

Same box, same password. Now a hundred helper twins need it, and they reach the box from all over town.

+1 The shared fridge

The kitchen's twins (from the badge office) need the pizza password too. The quick way: stick it on the kitchen's shared fridge, where every twin can grab it.

Kitchen fridge pizza-password: cGVwcGVyb25pLTc3

The fridge is a Kubernetes Secret: by default it is stored unencrypted, and anyone allowed to start a pod in that namespace can read it. The fix is an external secret store mounted through a CSI driver, plus a separate identity per pod.

+2 Robo's route to the box

The box has more than one door. Which one should Robo use?

The doors are endpoints: public, private (a VPC interface endpoint), FIPS, and a replica in another Region.

Peek at the real doors

The real public doors to AWS Secrets Manager, knocked on from a laptop. No account needed.

# The regular public door
$ secretsmanager.us-east-1.amazonaws.com
   answers with a badge issued by Amazon; the badge covers this exact name: True

# The certified FIPS door
$ secretsmanager-fips.us-east-1.amazonaws.com
   answers with a badge issued by Amazon; the badge covers this exact name: True

# The same door, another city
$ secretsmanager.us-west-2.amazonaws.com
   answers with a badge issued by Amazon; the badge covers this exact name: True

# The private hallway
   A VPC interface endpoint has no public address: it is reachable only from inside
   the customer's private network, so requests never cross the public internet.

Run it yourself: lab/front_doors.py.

Locked box: 0/7