diff --git a/docs/documentation/platform/secret-rotation/mysql.mdx b/docs/documentation/platform/secret-rotation/mysql.mdx index d6b912cbb..5bd658a0d 100644 --- a/docs/documentation/platform/secret-rotation/mysql.mdx +++ b/docs/documentation/platform/secret-rotation/mysql.mdx @@ -1,29 +1,90 @@ --- title: "MySQL/MariaDB" -description: "Rotated database user password of a MySQL or MariaDB" +description: "How to rotate MySQL/MariaDB database user passwords" --- -Infisical MySQL secret rotation allows you to automatically rotate your MySQL database user's password at regular intervals. +The Infisical MySQL secret rotation allows you to automatically rotate your MySQL database user's password at a predefined interval. - - At present Infisical do require access to your database. We will soon be released Infisical agent based rotation which would help you rotate without direct database access from Infisical cloud. - ## Prerequisite -1. Create two users with the required permission in your MySQL instance. Let's call them `user-a` and `user-b`. -2. Create another MySQL user with permission to update the passwords of `user-a` and `user-b`. Let's call it `admin` +1. Create two users with the required permission in your MySQL instance. We'll refer to them as `user-a` and `user-b`. +2. Create another MySQL user with just the permission to update the passwords of `user-a` and `user-b`. We'll refer to this user as the `admin` user. -To learn more about MySQL Permissioning, please follow this [documentation](https://dev.mysql.com/doc/refman/8.0/en/privileges-provided.html). +To learn more about MySQL permission system, please visit this [documentation](https://dev.mysql.com/doc/refman/8.0/en/privileges-provided.html). -## Working +## How it works 1. Infisical connects to your database using the provided `admin` user account. 2. A random value is generated and the password for `user-a` is updated with the new value. 3. The new password is then tested by logging into the database -4. If test is success, its saved to the output secret mappings so that rest of the system gets access. +4. If test is success, it's saved to the output secret mappings so that rest of the system gets the newly rotated value(s). 5. The process is then repeated for `user-b` on the next rotation. -6. And the loop continues. +6. The cycle repeats until secret rotation is deleted/stopped. + +## Rotation Configuration + + + + Head over to Secret Rotation configuration page of your project by clicking on `Secret Rotation` in the left side bar + + + + + Rotator admin username + + + + Rotator admin password + + + + Database host url + + + + Database port number + + + + The first username of two to rotate - `user-a` + + + + The second username of two to rotate - `user-b` + + + + Optional database certificate to connect with database + + + + + When a secret rotation is successful, the updated values needs to be saved to an existing key(s) in your project. + + + The environment where the rotated credentials should be mapped to. + + + + The secret path where the rotated credentials should be mapped to. + + + + What interval should the credentials be rotated in days. + + + + Select an existing secret key where the rotated database username value should be saved to. + + + + Select an existing select key where the rotated database password value should be saved to. + + + + +## FAQ @@ -34,69 +95,8 @@ To learn more about MySQL Permissioning, please follow this [documentation](http To avoid causing failure for them, the old credentials are not removed. Instead, in the next rotation, the previous user's credentials are updated. - The rotatora account is used by Infisical to update the credentials for `user-a` and `user-b`. + The admin account is used by Infisical to update the credentials for `user-a` and `user-b`. - You don't need to grant all permission for it. SQL has an amazing permission system, which means that the admin user only requires permission to update both the user passwords. + You don't need to grant all permission for your admin account but rather just the permissions to update both of the user's passwords. - -## Rotation Configuration - - - - Head over to Secret Rotation configuration page of your project by clicking on `Secret Rotation` in the left side bar - - - -![Secret Rotation Input](../../../images/secret-rotation/mysql-step1.png) - These are inputs required by MySQL Rotation Providers - - Here Admin username and password means the rotator account. You don't need to provide the Database admin account. - - - Admin Username - - Rotator Admin username - - - Admin password - - Rotator Admin password - - Host - - Database host url - - Port - Database port number - - - Username1 - - The first username in two to rotate - `user-a` - - - Username2 - - The second username in two to rotate - `user-b` - - - CA - - Certificate to connect with database(string) - - - -![Secret Rotation Output](../../../images/secret-rotation/postgres-step2.png) - - The secret keys to be replaced in the provided board after successful secret rotation - - - Select `Environment`, `Secret Path` and `Interval` to rotate the secrets - - Finally select the secrets in your provided board to replace with new secret after each rotation - - - DB Username - - The rotated database username. - - - DB Password - - The new generated credentials for the database user. - - - Your done and good to go. - - - -Congrats. You have 10x your MySQL/MariaDB access security. diff --git a/docs/documentation/platform/secret-rotation/postgres.mdx b/docs/documentation/platform/secret-rotation/postgres.mdx index 7c84ee2bb..1ddc7d558 100644 --- a/docs/documentation/platform/secret-rotation/postgres.mdx +++ b/docs/documentation/platform/secret-rotation/postgres.mdx @@ -1,29 +1,92 @@ --- title: "PostgreSQL/CockroachDB" -description: "Rotated database user password of a PostgreSQL or Cockroach DB" +description: "How to rotate postgreSQL/cockroach database user passwords" --- -Infisical Postgres secret rotation allows you to automatically rotate your PostgreSQL database user's password at regular intervals. +The Infisical Postgres secret rotation allows you to automatically rotate your Postgres database user's password at a predefined interval. - - At present Infisical do require access to your database. We will soon be released Infisical agent based rotation which would help you rotate without direct database access from Infisical cloud. - ## Prerequisite -1. Create two users with the required permission in your PostgreSQL instance. Let's call them `user-a` and `user-b`. -2. Create another PostgreSQL user with permission to update the passwords of `user-a` and `user-b`. Let's call it `admin` +1. Create two users with the required permission in your PostgreSQL instance. We'll refer to them as `user-a` and `user-b`. +2. Create another PostgreSQL user with just the permission to update the passwords of `user-a` and `user-b`. We'll refer to this user as the `admin` user. -To learn more about Postgres Permissioning, please follow this [documentation](https://www.postgresql.org/docs/9.1/sql-grant.html). +To learn more about Postgres permission system, please visit this [documentation](https://www.postgresql.org/docs/9.1/sql-grant.html). -## Working + +## How it works 1. Infisical connects to your database using the provided `admin` user account. 2. A random value is generated and the password for `user-a` is updated with the new value. -3. The new password is then tested by logging into the database. -4. If test is success, its saved to the output secret mappings so that rest of the system gets access. +3. The new password is then tested by logging into the database +4. If test is success, it's saved to the output secret mappings so that rest of the system gets the newly rotated value(s). 5. The process is then repeated for `user-b` on the next rotation. -6. And the loop continues. +6. The cycle repeats until secret rotation is deleted/stopped. + +## Rotation Configuration + + + + Head over to Secret Rotation configuration page of your project by clicking on `Secret Rotation` in the left side bar + + + + + + Rotator admin username + + + + Rotator admin password + + + + Database host url + + + + Database port number + + + + The first username of two to rotate - `user-a` + + + + The second username of two to rotate - `user-b` + + + + Optional database certificate to connect with database + + + + + When a secret rotation is successful, the updated values needs to be saved to an existing key(s) in your project. + + + The environment where the rotated credentials should be mapped to. + + + + The secret path where the rotated credentials should be mapped to. + + + + What interval should the credentials be rotated in days. + + + + Select an existing secret key where the rotated database username value should be saved to. + + + + Select an existing select key where the rotated database password value should be saved to. + + + + +## FAQ @@ -34,71 +97,8 @@ To learn more about Postgres Permissioning, please follow this [documentation](h To avoid causing failure for them, the old credentials are not removed. Instead, in the next rotation, the previous user's credentials are updated. - The rotator account is used by Infisical to update the credentials for `user-a` and `user-b`. + The admin account is used by Infisical to update the credentials for `user-a` and `user-b`. - You don't need to grant all permission for it. SQL has an amazing permission system, which means that the admin user only requires permission to update both the user passwords. + You don't need to grant all permission for your admin account but rather just the permissions to update both of the user's passwords. - -## Rotation Configuration - - - - Head over to Secret Rotation configuration page of your project by clicking on `Secret Rotation` in the left side bar - - - -![Secret Rotation Input](../../../images/secret-rotation/postgres-step1.png) - These are inputs required by PostgresSQL Rotation Providers - - - Here Admin username and password means the rotator account. You don't need to provide the Database admin account. - - - - Admin Username - - Rotator Admin username - - - Admin password - - Rotator Admin password - - Host - - Database host url - - Port - Database port number - - - Username1 - - The first username in two to rotate - `user-a` - - - Username2 - - The second username in two to rotate - `user-b` - - - CA - - Certificate to connect with database(string) - - - -![Secret Rotation Output](../../../images/secret-rotation/postgres-step2.png) - - The secret keys to be replaced in the provided board after successful secret rotation - - - Select `Environment`, `Secret Path` and `Interval` to rotate the secrets - - Finally select the secrets in your provided board to replace with new secret after each rotation - - - DB Username - - The rotated database username. - - - DB Password - - The new generated credentials for the database user. - - - Your done and good to go. - - - -Congratulations. You have improved your PostgreSQL/CockroachDB access security. diff --git a/docs/documentation/platform/secret-rotation/sendgrid.mdx b/docs/documentation/platform/secret-rotation/sendgrid.mdx index 4a3b6c78a..2a7b91a15 100644 --- a/docs/documentation/platform/secret-rotation/sendgrid.mdx +++ b/docs/documentation/platform/secret-rotation/sendgrid.mdx @@ -1,21 +1,20 @@ --- title: "Twilio SendGrid" -description: "Rotate Twilio SendGrid API keys" +description: "How to rotate Twilio SendGrid API keys" --- -Twilio SendGrid is a cloud-based email delivery platform that helps businesses send transactional and marketing emails. -The platform allows users to generate API keys to perform programmatic access. With Infisical, these keys can be dynamically rotated. +Eliminate the use of long lived secrets by rotating Twilio SendGrid API keys with Infisical. ## Prerequisite -A valid SendGrid admin key with the necessary scope to create additional API keys. Additionally, make sure that your new API keys have the required scopes to perform the desired tasks. +You will need a valid SendGrid admin key with the necessary scope to create additional API keys. Follow the [SendGrid Docs to create an admin api key](https://docs.sendgrid.com/ui/account-and-settings/api-keys) -## Working +## How it works -1. Using the provided admin key and the given scope in input Infisical will create and rotate API keys periodically -2. Under the hood infisical uses [SendGrid API](https://docs.sendgrid.com/api-reference/api-keys/create-api-keys) +Using the provided admin API key, Infisical will attempt to create child API keys with the specified permissions. +New keys will ge generated every time a rotation occurs. Behind the scenes, Infisical uses the [SendGrid API](https://docs.sendgrid.com/api-reference/api-keys/create-api-keys) to generate new API keys. ## Rotation Configuration @@ -25,28 +24,34 @@ Follow the [SendGrid Docs to create an admin api key](https://docs.sendgrid.com/ -![Secret Rotation Input](../../../images/secret-rotation/sendgrid-step1.png) - These are inputs required by SendGrid Rotation Providers + + SendGrid admin API key with permission to create child scoped API keys. + - - Admin API Key - - SendGrid admin API key to create lower scoped API keys. - - API Key Scopes - - SendGrid generated API Key's scopes. For more info refer [this doc](https://docs.sendgrid.com/api-reference/api-key-permissions/api-key-permissions) + + The permissions that the newly generated API keys will have. To view possible permissions, visit [this documentation](https://docs.sendgrid.com/api-reference/api-key-permissions/api-key-permissions). + Permissions must be entered as a list of strings. + + Example: `["user.profile.read", "user.profile.update"]` + -![Secret Rotation Input](../../../images/secret-rotation/sendgrid-step2.png) - The secret keys to be replaced in the provided board after successful secret rotation + When a secret rotation is successful, the updated values needs to be saved to an existing key(s) in your project. + + The environment where the rotated credentials should be mapped to. + - - Select `Environment`, `Secret Path` and `Interval` to rotate the secrets - - Finally select the secrets in your provided board to replace with new secret after each rotation + + The secret path where the rotated credentials should be mapped to. + - - API Key + + What interval should the credentials be rotated in days. + - The rotated new SendGrid API key - - - Your done and good to go. + + Select an existing select key where the newly rotated API key will get saved to. +