secrets-provider

Author: Frank Gu <[email protected]>

| Date | Revision | Remarks | | ---- | -------- | ------- | | Sept 10, 2019 | 1.0 | Initial documentation |

Overview

secrets-provider is designed as an NPM package that provides an abstraction for different secret sources. Sources are defined as "providers", and each provider has its own implementation of where and how to fetch and standardize the secrets for presentation.

Design

This module defines a single class, SecretsProvider, that is operated as a singleton. Private object methods (prefixed with underscores) provide the mainfunctionality of secrets processing. Static public accessors and mutators provide the developer-facing API to interact with the secrets manager.

Due to the asynchronous nature of providers and the need for synchronous secrets access, secrets-provider implements a fetch() loop that will execute on a daily basis (0 1 * * *) to grab fresh credentials form the provider. This fetch() function is also called on start(), which loads the initial set of credentials. After start(), users can synchronously get() the latest cached credentials.

At the end of the application lifecycle, the developer should stop() the instance to gracefully clean up the cron job.

Usage

const secretsProvider = require('@voiceflow/secrets-provider');
const config = {
  SECRETS_PROVIDER: 'aws', // 'local', 'test'
  API_KEYS_SECRET: "api_keys_secret_name",    // Only if 'aws'
  MAIN_DB_SECRET: "main_db_secret_name",      // Only if 'aws'
  LOGGING_DB_SECRET: "logging_db_secret_name" // Only if 'aws'
}
// ...

const asyncInitFunction = async () => {
  // ...
  await secretsProvider.start(config);
}

const someFunction = () => {
  const secret = secretsProviders.get('secret_field');
  // Code that uses secret
}

const asyncCleanupFunction = async () => {
  // Cleanup code
  await secretsProvider.stop();
}

Secrets are strictly returned as string type. Checks for database secret fields are implemented for aws provider; it is the responsibility of the developer to ensure that their test and local secrets contain the intended correct information.