diff --git a/docs/documentation/platform/dynamic-secrets/overview.mdx b/docs/documentation/platform/dynamic-secrets/overview.mdx new file mode 100644 index 000000000..29b4ffa97 --- /dev/null +++ b/docs/documentation/platform/dynamic-secrets/overview.mdx @@ -0,0 +1,30 @@ +--- +title: "Dynamic Secrets Overview" +description: "Learn how to generate secrets dynamically on-demand." +--- + +## Introduction + +Contrary to static key-value secrets, which require manual input of data into the secure Infisical storage, dynamic secrets are generated on-demand upon access. + +Dynamic secrets are unique to every identity using them. Such secrets come are generated only at the moment they are retrieved, eliminating the possibility of theft or reuse by another identity. Thanks to Infisical's integrated revocation capabilities, dynamic secrets can be promptly invalidated post-use, significantly reducing their lifespan. + +## Benefits of Dynamic Secrets + +This approach offers several advantages in terms of security and management: + +- **Enhanced Security**: By frequently changing secrets, dynamic secrets minimize the risk associated with secret compromise. Even if an attacker manages to obtain a secret, it would likely be invalid by the time they attempt to use it. + +- **Reduced Secret Lifetime**: The limited validity period of dynamic secrets means that they are less valuable targets for attackers. This inherently reduces the time window during which a secret can be exploited. + +- **Automated Management**: Dynamic secrets enable automated systems to handle the generation, distribution, revocation, and rotation of secrets without human intervention, thus reducing the risk of human error. + +- **Auditing and Traceability**: The generation of dynamic secrets can be tightly controlled and monitored. This allows for detailed auditing of who accessed what secret and when, improving overall security posture and compliance with regulatory standards. + +- **Scalability**: Dynamic secret management systems can scale more effectively to handle a large number of services and applications, as they automate much of the overhead associated with manual secret management. + +Dynamic secrets are particularly useful in environments with stringent security requirements, such as cloud environments, distributed systems, and microservices architectures, where they help to manage database credentials, API keys, service tokens, and other types of secrets. + +## Infisical Dynamic Secret Templates + +1. [PostgreSQL](./sql-database) diff --git a/docs/documentation/platform/dynamic-secrets/postgresql.mdx b/docs/documentation/platform/dynamic-secrets/postgresql.mdx new file mode 100644 index 000000000..8b1b9f9c2 --- /dev/null +++ b/docs/documentation/platform/dynamic-secrets/postgresql.mdx @@ -0,0 +1,100 @@ +--- +title: "PostgreSQL" +description: "Learn how to dynamically generate PostgreSQL Database user passwords." +--- + +The Infisical MySQL secret rotation allows you to automatically rotate your MySQL database user's password at a predefined interval. + + +## Prerequisite + +1. Create a user with the required permission in your SQL instance. We'll refer to them as `user-a` and `user-b`. +2. Create another MySQL user with just the permission to update the passwords of `user-a` and `user-b`. We'll refer to this user as the `admin` user. + +To learn more about MySQL permission system, please visit this [documentation](https://dev.mysql.com/doc/refman/8.0/en/privileges-provided.html). + +## How it works + +1. Infisical connects to your database using the provided `admin` user account. +2. A random value is generated and the password for `user-a` is updated with the new value. +3. The new password is then tested by logging into the database +4. If test is success, it's saved to the output secret mappings so that rest of the system gets the newly rotated value(s). +5. The process is then repeated for `user-b` on the next rotation. +6. The cycle repeats until secret rotation is deleted/stopped. + +## Rotation Configuration + + + + Head over to Secret Rotation configuration page of your project by clicking on `Secret Rotation` in the left side bar + + + ![Add Dynamic Secret Button](../../images/platform/dynamic-secrets/add-dynamic-secret.png) + + + ![Dynamic Secret Modal](../../images/platform/dynamic-secrets/dynamic-secret-modal.png) + + + + Name by which you want the secret to be referenced + + + + Default time-to-live for a generated secret (it is possible to modify this value when a secret is generate) + + + + Maximum time-to-live for a generated secret + + + + Choose the service you want to generate dynamic secrets for + + + + Database host + + + + Database port + + + + Username that will be used to create dynamic secrets + + + + Password that will be used to create dynamic secrets + + + + Name of the database for which you want to create dynamic secrets + + + + Optional database certificate to connect with database + + + ![Dynamic Secret Setup Modal](../../images/platform/dynamic-secrets/dynamic-secret-setup-modal.png) + + + + If you want to provide specific privileges for the future generated dynamic secrets, you are able to specify them as SQL statements. + + ![Modify SQL Statements Modal](../../images/platform/dynamic-secrets/modify-sql-statements.png) + + + After submitting the form, you will see a dynamic secret creates in the dashboard. + + + If this step fails, you might have to add the CA certficate. + + + ![Dynamic Secret](../../images/platform/dynamic-secrets/dynamic-secret.png) + + + Now that the dynamic secret is created, you can start generating unique secret values by specifying the Time-to-live within the predefined range. + + ![Provision Lease](../../images/platform/dynamic-secrets/provision-lease.png) + + diff --git a/docs/images/platform/dynamic-secrets/add-dynamic-secret-button.png b/docs/images/platform/dynamic-secrets/add-dynamic-secret-button.png new file mode 100644 index 000000000..8d0fd3ecc Binary files /dev/null and b/docs/images/platform/dynamic-secrets/add-dynamic-secret-button.png differ diff --git a/docs/images/platform/dynamic-secrets/dynamic-secret-modal.png b/docs/images/platform/dynamic-secrets/dynamic-secret-modal.png new file mode 100644 index 000000000..5f487dd7f Binary files /dev/null and b/docs/images/platform/dynamic-secrets/dynamic-secret-modal.png differ diff --git a/docs/images/platform/dynamic-secrets/dynamic-secret-setup-modal.png b/docs/images/platform/dynamic-secrets/dynamic-secret-setup-modal.png new file mode 100644 index 000000000..3cd6c06f6 Binary files /dev/null and b/docs/images/platform/dynamic-secrets/dynamic-secret-setup-modal.png differ diff --git a/docs/images/platform/dynamic-secrets/dynamic-secret.png b/docs/images/platform/dynamic-secrets/dynamic-secret.png new file mode 100644 index 000000000..f08fc4c55 Binary files /dev/null and b/docs/images/platform/dynamic-secrets/dynamic-secret.png differ diff --git a/docs/images/platform/dynamic-secrets/modify-sql-statements.png b/docs/images/platform/dynamic-secrets/modify-sql-statements.png new file mode 100644 index 000000000..d0f3b09da Binary files /dev/null and b/docs/images/platform/dynamic-secrets/modify-sql-statements.png differ diff --git a/docs/images/platform/dynamic-secrets/provision-lease.png b/docs/images/platform/dynamic-secrets/provision-lease.png new file mode 100644 index 000000000..f144a5ae2 Binary files /dev/null and b/docs/images/platform/dynamic-secrets/provision-lease.png differ diff --git a/docs/mint.json b/docs/mint.json index 625974241..3ad3c0ca9 100644 --- a/docs/mint.json +++ b/docs/mint.json @@ -143,6 +143,13 @@ "documentation/platform/secret-rotation/aws-iam" ] }, + { + "group": "Dynamic Secrets", + "pages": [ + "documentation/platform/dynamic-secrets/overview", + "documentation/platform/dynamic-secrets/postgresql" + ] + }, { "group": "SSO", "pages": [ diff --git a/frontend/src/views/SecretMainPage/components/ActionBar/CreateDynamicSecretForm/SqlDatabaseInputForm.tsx b/frontend/src/views/SecretMainPage/components/ActionBar/CreateDynamicSecretForm/SqlDatabaseInputForm.tsx index c0dff20f5..75b347361 100644 --- a/frontend/src/views/SecretMainPage/components/ActionBar/CreateDynamicSecretForm/SqlDatabaseInputForm.tsx +++ b/frontend/src/views/SecretMainPage/components/ActionBar/CreateDynamicSecretForm/SqlDatabaseInputForm.tsx @@ -217,7 +217,11 @@ export const SqlDatabaseInputForm = ({ isError={Boolean(error?.message)} errorText={error?.message} > - + field.onChange(parseInt(el.target.value, 10))} + /> )} /> diff --git a/frontend/src/views/SecretMainPage/components/DynamicSecretListView/CreateDynamicSecretLease.tsx b/frontend/src/views/SecretMainPage/components/DynamicSecretListView/CreateDynamicSecretLease.tsx index 3eb80c9b4..dd203ce42 100644 --- a/frontend/src/views/SecretMainPage/components/DynamicSecretListView/CreateDynamicSecretLease.tsx +++ b/frontend/src/views/SecretMainPage/components/DynamicSecretListView/CreateDynamicSecretLease.tsx @@ -124,7 +124,7 @@ export const CreateDynamicSecretLease = ({ console.log(error); createNotification({ type: "error", - text: "Failed to deleted dynamic secret" + text: "Failed to create dynamic secret" }); } };