awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-09-22 13:39:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix types, rephrase, and revise rotation docs

Browse Source
This commit is contained in:
Maidul Islam
2024-03-21 11:03:41 -04:00
parent 8c491668dc
commit 242179598b
3 changed files with 179 additions and 174 deletions
Download Patch File Download Diff File Expand all files Collapse all files

148
docs/documentation/platform/secret-rotation/mysql.mdx
View File

@@ -1,29 +1,90 @@
---
title: "MySQL/MariaDB"
description: "Rotated database user password of a MySQL or MariaDB"
description: "How to rotate MySQL/MariaDB database user passwords"
---
Infisical MySQL secret rotation allows you to automatically rotate your MySQL database user's password at regular intervals.
The Infisical MySQL secret rotation allows you to automatically rotate your MySQL database user's password at a predefined interval.
<Warning>
At present Infisical do require access to your database. We will soon be released Infisical agent based rotation which would help you rotate without direct database access from Infisical cloud.
</Warning>
## Prerequisite
1. Create two users with the required permission in your MySQL instance. Let's call them `user-a` and `user-b`.
2. Create another MySQL user with permission to update the passwords of `user-a` and `user-b`. Let's call it `admin`
1. Create two users with the required permission in your MySQL instance. We'll refer to them as `user-a` and `user-b`.
2. Create another MySQL user with just the permission to update the passwords of `user-a` and `user-b`. We'll refer to this user as the `admin` user.
To learn more about MySQL Permissioning, please follow this [documentation](https://dev.mysql.com/doc/refman/8.0/en/privileges-provided.html).
To learn more about MySQL permission system, please visit this [documentation](https://dev.mysql.com/doc/refman/8.0/en/privileges-provided.html).
## Working
## How it works
1. Infisical connects to your database using the provided `admin` user account.
2. A random value is generated and the password for `user-a` is updated with the new value.
3. The new password is then tested by logging into the database
4. If test is success, its saved to the output secret mappings so that rest of the system gets access.
4. If test is success, it's saved to the output secret mappings so that rest of the system gets the newly rotated value(s).
5. The process is then repeated for `user-b` on the next rotation.
6. And the loop continues.
6. The cycle repeats until secret rotation is deleted/stopped.
## Rotation Configuration
<Steps>
<Step title="Open Secret Rotation Page">
Head over to Secret Rotation configuration page of your project by clicking on `Secret Rotation` in the left side bar
</Step>
<Step title="Click on MySQL card" />
<Step title="Provide the inputs">
<ParamField path="Admin Username" type="string" required>
Rotator admin username
</ParamField>
<ParamField path="Admin password" type="string" required>
Rotator admin password
</ParamField>
<ParamField path="Host" type="string" required>
Database host url
</ParamField>
<ParamField path="Port" type="number" required>
Database port number
</ParamField>
<ParamField path="Username1" type="string" required>
The first username of two to rotate - `user-a`
</ParamField>
<ParamField path="Username2" type="string" required>
The second username of two to rotate - `user-b`
</ParamField>
<ParamField path="CA" type="string">
Optional database certificate to connect with database
</ParamField>
</Step>
<Step title="Configure the output secret mapping">
When a secret rotation is successful, the updated values needs to be saved to an existing key(s) in your project.
<ParamField path="Environment" type="string" required>
The environment where the rotated credentials should be mapped to.
</ParamField>
<ParamField path="Secret Path" type="string" required>
The secret path where the rotated credentials should be mapped to.
</ParamField>
<ParamField path="Interval" type="number" required>
What interval should the credentials be rotated in days.
</ParamField>
<ParamField path="DB USERNAME" type="string" required>
Select an existing secret key where the rotated database username value should be saved to.
</ParamField>
<ParamField path="DB PASSWORD" type="string" required>
Select an existing select key where the rotated database password value should be saved to.
</ParamField>
</Step>
</Steps>
## FAQ
<AccordionGroup>
<Accordion title="Why can't we delete the other user when rotating?">
@@ -34,69 +95,8 @@ To learn more about MySQL Permissioning, please follow this [documentation](http
To avoid causing failure for them, the old credentials are not removed. Instead, in the next rotation, the previous user's credentials are updated.
</Accordion>
<Accordion title="Why do you need root user account?">
The rotatora account is used by Infisical to update the credentials for `user-a` and `user-b`.
The admin account is used by Infisical to update the credentials for `user-a` and `user-b`.
You don't need to grant all permission for it. SQL has an amazing permission system, which means that the admin user only requires permission to update both the user passwords.
You don't need to grant all permission for your admin account but rather just the permissions to update both of the user's passwords.
</Accordion>
</AccordionGroup>
## Rotation Configuration
<Steps>
<Step title="Open Secret Rotation Page">
Head over to Secret Rotation configuration page of your project by clicking on `Secret Rotation` in the left side bar
</Step>
<Step title="Click on MySQL Card" />
<Step title="Provide the inputs">
![Secret Rotation Input](../../../images/secret-rotation/mysql-step1.png)
These are inputs required by MySQL Rotation Providers
<Info>
Here Admin username and password means the rotator account. You don't need to provide the Database admin account.
</Info>
- Admin Username
Rotator Admin username
- Admin password
Rotator Admin password
- Host
Database host url
- Port
Database port number
- Username1
The first username in two to rotate - `user-a`
- Username2
The second username in two to rotate - `user-b`
- CA
Certificate to connect with database(string)
</Step>
<Step title="Configure the output secret mapping">
![Secret Rotation Output](../../../images/secret-rotation/postgres-step2.png)
The secret keys to be replaced in the provided board after successful secret rotation
- Select `Environment`, `Secret Path` and `Interval` to rotate the secrets
- Finally select the secrets in your provided board to replace with new secret after each rotation
- DB Username
The rotated database username.
- DB Password
The new generated credentials for the database user.
- Your done and good to go.
</Step>
</Steps>
Congrats. You have 10x your MySQL/MariaDB access security.

154
docs/documentation/platform/secret-rotation/postgres.mdx
View File

@@ -1,29 +1,92 @@
---
title: "PostgreSQL/CockroachDB"
description: "Rotated database user password of a PostgreSQL or Cockroach DB"
description: "How to rotate postgreSQL/cockroach database user passwords"
---
Infisical Postgres secret rotation allows you to automatically rotate your PostgreSQL database user's password at regular intervals.
The Infisical Postgres secret rotation allows you to automatically rotate your Postgres database user's password at a predefined interval.
<Warning>
At present Infisical do require access to your database. We will soon be released Infisical agent based rotation which would help you rotate without direct database access from Infisical cloud.
</Warning>
## Prerequisite
1. Create two users with the required permission in your PostgreSQL instance. Let's call them `user-a` and `user-b`.
2. Create another PostgreSQL user with permission to update the passwords of `user-a` and `user-b`. Let's call it `admin`
1. Create two users with the required permission in your PostgreSQL instance. We'll refer to them as `user-a` and `user-b`.
2. Create another PostgreSQL user with just the permission to update the passwords of `user-a` and `user-b`. We'll refer to this user as the `admin` user.
To learn more about Postgres Permissioning, please follow this [documentation](https://www.postgresql.org/docs/9.1/sql-grant.html).
To learn more about Postgres permission system, please visit this [documentation](https://www.postgresql.org/docs/9.1/sql-grant.html).
## Working
## How it works
1. Infisical connects to your database using the provided `admin` user account.
2. A random value is generated and the password for `user-a` is updated with the new value.
3. The new password is then tested by logging into the database.
4. If test is success, its saved to the output secret mappings so that rest of the system gets access.
3. The new password is then tested by logging into the database
4. If test is success, it's saved to the output secret mappings so that rest of the system gets the newly rotated value(s).
5. The process is then repeated for `user-b` on the next rotation.
6. And the loop continues.
6. The cycle repeats until secret rotation is deleted/stopped.
## Rotation Configuration
<Steps>
<Step title="Open Secret Rotation Page">
Head over to Secret Rotation configuration page of your project by clicking on `Secret Rotation` in the left side bar
</Step>
<Step title="Click on PostgresSQL card" />
<Step title="Provide the inputs">
<ParamField path="Admin Username" type="string" required="true">
Rotator admin username
</ParamField>
<ParamField path="Admin password" type="string" required="true">
Rotator admin password
</ParamField>
<ParamField path="Host" type="string" required="true">
Database host url
</ParamField>
<ParamField path="Port" type="number" required="true">
Database port number
</ParamField>
<ParamField path="Username1" type="string" required="true">
The first username of two to rotate - `user-a`
</ParamField>
<ParamField path="Username2" type="string" required="true">
The second username of two to rotate - `user-b`
</ParamField>
<ParamField path="CA" type="string" optional>
Optional database certificate to connect with database
</ParamField>
</Step>
<Step title="Configure the output secret mapping">
When a secret rotation is successful, the updated values needs to be saved to an existing key(s) in your project.
<ParamField path="Environment" type="string" required>
The environment where the rotated credentials should be mapped to.
</ParamField>
<ParamField path="Secret Path" type="string" required>
The secret path where the rotated credentials should be mapped to.
</ParamField>
<ParamField path="Interval" type="number" required>
What interval should the credentials be rotated in days.
</ParamField>
<ParamField path="DB USERNAME" type="string" required>
Select an existing secret key where the rotated database username value should be saved to.
</ParamField>
<ParamField path="DB PASSWORD" type="string" required>
Select an existing select key where the rotated database password value should be saved to.
</ParamField>
</Step>
</Steps>
## FAQ
<AccordionGroup>
<Accordion title="Why can't we delete the other user when rotating?">
@@ -34,71 +97,8 @@ To learn more about Postgres Permissioning, please follow this [documentation](h
To avoid causing failure for them, the old credentials are not removed. Instead, in the next rotation, the previous user's credentials are updated.
</Accordion>
<Accordion title="Why do you need root user account?">
The rotator account is used by Infisical to update the credentials for `user-a` and `user-b`.
The admin account is used by Infisical to update the credentials for `user-a` and `user-b`.
You don't need to grant all permission for it. SQL has an amazing permission system, which means that the admin user only requires permission to update both the user passwords.
You don't need to grant all permission for your admin account but rather just the permissions to update both of the user's passwords.
</Accordion>
</AccordionGroup>
## Rotation Configuration
<Steps>
<Step title="Open Secret Rotation Page">
Head over to Secret Rotation configuration page of your project by clicking on `Secret Rotation` in the left side bar
</Step>
<Step title="Click on PostgresSQL Card" />
<Step title="Provide the inputs">
![Secret Rotation Input](../../../images/secret-rotation/postgres-step1.png)
These are inputs required by PostgresSQL Rotation Providers
<Info>
Here Admin username and password means the rotator account. You don't need to provide the Database admin account.
</Info>
- Admin Username
Rotator Admin username
- Admin password
Rotator Admin password
- Host
Database host url
- Port
Database port number
- Username1
The first username in two to rotate - `user-a`
- Username2
The second username in two to rotate - `user-b`
- CA
Certificate to connect with database(string)
</Step>
<Step title="Configure the output secret mapping">
![Secret Rotation Output](../../../images/secret-rotation/postgres-step2.png)
The secret keys to be replaced in the provided board after successful secret rotation
- Select `Environment`, `Secret Path` and `Interval` to rotate the secrets
- Finally select the secrets in your provided board to replace with new secret after each rotation
- DB Username
The rotated database username.
- DB Password
The new generated credentials for the database user.
- Your done and good to go.
</Step>
</Steps>
Congratulations. You have improved your PostgreSQL/CockroachDB access security.

51
docs/documentation/platform/secret-rotation/sendgrid.mdx
View File

@@ -1,21 +1,20 @@
---
title: "Twilio SendGrid"
description: "Rotate Twilio SendGrid API keys"
description: "How to rotate Twilio SendGrid API keys"
---
Twilio SendGrid is a cloud-based email delivery platform that helps businesses send transactional and marketing emails.
The platform allows users to generate API keys to perform programmatic access. With Infisical, these keys can be dynamically rotated.
Eliminate the use of long lived secrets by rotating Twilio SendGrid API keys with Infisical.
## Prerequisite
A valid SendGrid admin key with the necessary scope to create additional API keys. Additionally, make sure that your new API keys have the required scopes to perform the desired tasks.
You will need a valid SendGrid admin key with the necessary scope to create additional API keys.
Follow the [SendGrid Docs to create an admin api key](https://docs.sendgrid.com/ui/account-and-settings/api-keys)
## Working
## How it works
1. Using the provided admin key and the given scope in input Infisical will create and rotate API keys periodically
2. Under the hood infisical uses [SendGrid API](https://docs.sendgrid.com/api-reference/api-keys/create-api-keys)
Using the provided admin API key, Infisical will attempt to create child API keys with the specified permissions.
New keys will ge generated every time a rotation occurs. Behind the scenes, Infisical uses the [SendGrid API](https://docs.sendgrid.com/api-reference/api-keys/create-api-keys) to generate new API keys.
## Rotation Configuration
@@ -25,28 +24,34 @@ Follow the [SendGrid Docs to create an admin api key](https://docs.sendgrid.com/
</Step>
<Step title="Click on Twilio SendGrid Card" />
<Step title="Provide the inputs">
![Secret Rotation Input](../../../images/secret-rotation/sendgrid-step1.png)
These are inputs required by SendGrid Rotation Providers
<ParamField path="Admin API Key" type="string" required>
SendGrid admin API key with permission to create child scoped API keys.
</ParamField>
- Admin API Key
SendGrid admin API key to create lower scoped API keys.
- API Key Scopes
SendGrid generated API Key's scopes. For more info refer [this doc](https://docs.sendgrid.com/api-reference/api-key-permissions/api-key-permissions)
<ParamField path="Admin API Key" type="array" required>
The permissions that the newly generated API keys will have. To view possible permissions, visit [this documentation](https://docs.sendgrid.com/api-reference/api-key-permissions/api-key-permissions).
Permissions must be entered as a list of strings.
Example: `["user.profile.read", "user.profile.update"]`
</ParamField>
</Step>
<Step title="Configure the output secret mapping">
![Secret Rotation Input](../../../images/secret-rotation/sendgrid-step2.png)
The secret keys to be replaced in the provided board after successful secret rotation
When a secret rotation is successful, the updated values needs to be saved to an existing key(s) in your project.
<ParamField path="Environment" type="string" required>
The environment where the rotated credentials should be mapped to.
</ParamField>
- Select `Environment`, `Secret Path` and `Interval` to rotate the secrets
- Finally select the secrets in your provided board to replace with new secret after each rotation
<ParamField path="Secret Path" type="string" required>
The secret path where the rotated credentials should be mapped to.
</ParamField>
- API Key
<ParamField path="Interval" type="number" required>
What interval should the credentials be rotated in days.
</ParamField>
The rotated new SendGrid API key
- Your done and good to go.
<ParamField path="API KEY" type="string" required>
Select an existing select key where the newly rotated API key will get saved to.
</ParamField>
</Step>
</Steps>