awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-09-22 13:39:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

improvements: address feedback, feature docs and cert validation with dns rebinding handling

Browse Source
This commit is contained in:
Scott Wilson
2025-04-03 21:17:04 -07:00
parent 577c81be65
commit 715441908b
24 changed files with 708 additions and 306 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
backend/src/ee/services/secret-rotation-v2/secret-rotation-v2-service.ts
View File

@@ -153,6 +153,12 @@ export const secretRotationV2ServiceFactory = ({
tx: Knex;
secretPath: string;
}) => {
if (new Set(secretKeys).size !== secretKeys.length) {
throw new BadRequestError({
message: `Secrets mapping keys must be unique. "${secretKeys.join(", ")}" contains duplicate keys.`
});
}
const conflictingSecrets = await secretV2BridgeDAL.find(
{
$in: {

1
backend/src/lib/config/env.ts
View File

@@ -59,6 +59,7 @@ const envSchema = z
QUEUE_WORKERS_ENABLED: zodStrBool.default("true"),
HTTPS_ENABLED: zodStrBool,
ROTATION_DEVELOPMENT_MODE: zodStrBool.default("false").optional(),
DB_SSL_REJECT_UNAUTHORIZED: zodStrBool.default("true"),
// smtp options
SMTP_HOST: zpStr(z.string().optional()),
SMTP_IGNORE_TLS: zodStrBool.default("false"),

9
backend/src/services/app-connection/shared/sql/sql-connection-fns.ts
View File

@@ -5,6 +5,7 @@ import {
TSqlCredentialsRotationGeneratedCredentials,
TSqlCredentialsRotationWithConnection
} from "@app/ee/services/secret-rotation-v2/shared/sql-credentials/sql-credentials-rotation-types";
import { getConfig } from "@app/lib/config/env";
import { BadRequestError, DatabaseError } from "@app/lib/errors";
import { alphaNumericNanoId } from "@app/lib/nanoid";
import { AppConnection } from "@app/services/app-connection/app-connection-enums";
@@ -19,12 +20,16 @@ const SQL_CONNECTION_CLIENT_MAP = {
};
export const getSqlConnectionClient = async (appConnection: Pick<TSqlConnection, "credentials" | "app">) => {
const appCfg = getConfig();
const {
app,
credentials: { host: baseHost, database, port, sslCertificate, password, username }
} = appConnection;
const ssl = sslCertificate ? { rejectUnauthorized: false, ca: sslCertificate } : undefined;
const ssl = sslCertificate
? { rejectUnauthorized: appCfg.DB_SSL_REJECT_UNAUTHORIZED, ca: sslCertificate, servername: baseHost }
: undefined;
const [host] = await verifyHostInputValidity(baseHost);
@@ -43,7 +48,7 @@ export const getSqlConnectionClient = async (appConnection: Pick<TSqlConnection,
options:
app === AppConnection.MsSql
? {
trustServerCertificate: !sslCertificate,
trustServerCertificate: !appCfg.DB_SSL_REJECT_UNAUTHORIZED,
cryptoCredentialsDetails: sslCertificate ? { ca: sslCertificate } : {}
}
: undefined

8
docs/api-reference/endpoints/app-connections/mssql/create.mdx
View File

@@ -1,4 +1,10 @@
---
title: "Create"
openapi: "POST /api/v1/app-connections/mssql"
---
---
<Note>
Check out the configuration docs for [Microsoft SQL Server
Connections](/integrations/app-connections/mssql) to learn how to obtain the
required credentials.
</Note>

8
docs/api-reference/endpoints/app-connections/mssql/update.mdx
View File

@@ -1,4 +1,10 @@
---
title: "Update"
openapi: "PATCH /api/v1/app-connections/mssql/{connectionId}"
---
---
<Note>
Check out the configuration docs for [Microsoft SQL Server
Connections](/integrations/app-connections/mssql) to learn how to obtain the
required credentials.
</Note>

8
docs/api-reference/endpoints/app-connections/postgres/create.mdx
View File

@@ -1,4 +1,10 @@
---
title: "Create"
openapi: "POST /api/v1/app-connections/postgres"
---
---
<Note>
Check out the configuration docs for [PostgreSQL
Connections](/integrations/app-connections/postgres) to learn how to obtain the
required credentials.
</Note>

8
docs/api-reference/endpoints/app-connections/postgres/update.mdx
View File

@@ -1,4 +1,10 @@
---
title: "Update"
openapi: "PATCH /api/v1/app-connections/postgres/{connectionId}"
---
---
<Note>
Check out the configuration docs for [PostgreSQL
Connections](/integrations/app-connections/postgres) to learn how to obtain the
required credentials.
</Note>

6
docs/api-reference/endpoints/secret-rotations/mssql-credentials/create.mdx
View File

@@ -2,3 +2,9 @@
title: "Create"
openapi: "POST /api/v2/secret-rotations/mssql-credentials"
---
<Note>
Check out the configuration docs for [Microsoft SQL Server
Credentials Rotations](/documentation/platform/secret-rotation/mssql) to learn how to obtain the
required parameters.
</Note>

6
docs/api-reference/endpoints/secret-rotations/mssql-credentials/update.mdx
View File

@@ -2,3 +2,9 @@
title: "Update"
openapi: "PATCH /api/v2/secret-rotations/mssql-credentials/{rotationId}"
---
<Note>
Check out the configuration docs for [Microsoft SQL Server
Credentials Rotations](/documentation/platform/secret-rotation/mssql) to learn how to obtain the
required parameters.
</Note>

6
docs/api-reference/endpoints/secret-rotations/postgres-credentials/create.mdx
View File

@@ -2,3 +2,9 @@
title: "Create"
openapi: "POST /api/v2/secret-rotations/postgres-credentials"
---
<Note>
Check out the configuration docs for [PostgreSQL
Credentials Rotations](/documentation/platform/secret-rotation/postgres) to learn how to obtain the
required parameters.
</Note>

6
docs/api-reference/endpoints/secret-rotations/postgres-credentials/update.mdx
View File

@@ -2,3 +2,9 @@
title: "Update"
openapi: "PATCH /api/v2/secret-rotations/postgres-credentials/{rotationId}"
---
<Note>
Check out the configuration docs for [PostgreSQL
Credentials Rotations](/documentation/platform/secret-rotation/postgres) to learn how to obtain the
required parameters.
</Note>

248
docs/documentation/platform/secret-rotation/mssql.mdx
View File

@@ -1,139 +1,163 @@
---
title: "Microsoft SQL Server"
description: "Learn how to automatically rotate Microsoft SQL Server user passwords."
title: "Microsoft SQL Server Credentials"
description: "Learn how to automatically rotate Microsoft SQL Server credentials."
---
The Infisical SQL Server secret rotation allows you to automatically rotate your database users' passwords at a predefined interval.
## Prerequisites
1. Create two SQL Server logins and database users with the required permissions. We'll refer to them as `user-a` and `user-b`.
2. Create another SQL Server login with permissions to alter logins for `user-a` and `user-b`. We'll refer to this as the `admin` login.
1. Create a [Microsoft SQL Server Connection](/integrations/app-connections/mssql) with the required **Secret Rotation** permissions
2. Create two designated database users for Infisical to rotate the credentials for. Be sure to grant each user login permissions for the desired database with the necessary privileges their use case will require.
Here's how to set up the prerequisites:
An example creation statement might look like:
```SQL
-- create server-level logins
CREATE LOGIN infisical_user_1 WITH PASSWORD = 'my-password';
CREATE LOGIN infisical_user_2 WITH PASSWORD = 'my-password';
```sql
-- Create the logins (at server level)
CREATE LOGIN [user-a] WITH PASSWORD = 'ComplexPassword1';
CREATE LOGIN [user-b] WITH PASSWORD = 'ComplexPassword2';
-- create database-level users with login from above
USE my_database;
CREATE USER infisical_user_1 FOR LOGIN infisical_user_1;
CREATE USER infisical_user_2 FOR LOGIN infisical_user_2;
GRANT CONNECT TO infisical_user_1;
GRANT CONNECT TO infisical_user_2;
-- Create database users for the logins (in your specific database)
USE [YourDatabase];
CREATE USER [user-a] FOR LOGIN [user-a];
CREATE USER [user-b] FOR LOGIN [user-b];
-- grant relevant permissions
GRANT SELECT, INSERT, UPDATE, DELETE ON SCHEMA::dbo TO infisical_user_1;
GRANT SELECT, INSERT, UPDATE, DELETE ON SCHEMA::dbo TO infisical_user_2;
```
-- Grant necessary permissions to the users
GRANT SELECT, INSERT, UPDATE, DELETE ON SCHEMA::dbo TO [user-a];
GRANT SELECT, INSERT, UPDATE, DELETE ON SCHEMA::dbo TO [user-b];
<Tip>
To learn more about Microsoft SQL Server's permission system, please visit their [documentation](https://learn.microsoft.com/en-us/sql/t-sql/statements/grant-transact-sql?view=sql-server-ver16).
</Tip>
-- Create admin login with permission to alter other logins
CREATE LOGIN [admin] WITH PASSWORD = 'AdminComplexPassword';
CREATE USER [admin] FOR LOGIN [admin];
-- Grant permission to alter any login
GRANT ALTER ANY LOGIN TO [admin];
```
## Create a Microsoft SQL Server Credentials Rotation in Infisical
To learn more about SQL Server's permission system, please visit this [documentation](https://learn.microsoft.com/en-us/sql/relational-databases/security/authentication-access/getting-started-with-database-engine-permissions).
<Tabs>
<Tab title="Infisical UI">
1. Navigate to your Secret Manager Project's Dashboard and select **Add Secret Rotation** from the actions dropdown.
![Secret Manager Dashboard](/images/secret-rotations-v2/generic/add-secret-rotation.png)
## How it works
2. Select the **Microsoft SQL Server Credentials** option.
![Select Microsoft SQL Server Credentials](/images/secret-rotations-v2/mssql-credentials/select-mssql-credentials-option.png)
1. Infisical connects to your database using the provided `admin` login credentials.
2. A random value is generated and the password for `user-a` is updated with the new value.
3. The new password is then tested by logging into the database.
4. If test is successful, it's saved to the output secret mappings so that rest of the system gets the newly rotated value(s).
5. The process is then repeated for `user-b` on the next rotation.
6. The cycle repeats until secret rotation is deleted/stopped.
3. Select the **Microsoft SQL Server Connection** to use and configure the rotation behavior. Then click **Next**.
![Rotation Configuration](/images/secret-rotations-v2/mssql-credentials/mssql-credentials-configuration.png)
## Rotation Configuration
- **Microsoft SQL Server Connection** - the connection that will perform the rotation of the configured database user credentials.
- **Rotation Interval** - the interval, in days, that once elapsed will trigger a rotation.
- **Rotate At** - the local time of day when rotation should occur once the interval has elapsed.
- **Auto-Rotation Enabled** - whether secrets should automatically be rotated once the rotation interval has elapsed. Disable this option to manually rotate secrets or pause secret rotation.
<Steps>
<Step title="Open Secret Rotation Page">
Head over to Secret Rotation configuration page of your project by clicking on `Secret Rotation` in the left side bar
</Step>
<Step title="Click on Microsoft SQL Server card" />
<Step title="Provide the inputs">
<ParamField path="Admin Username" type="string" required>
SQL Server admin username
</ParamField>
4. Input the the usernames of the database roles created above that will be used for rotation. The click **Next**.
![Rotation Parameters](/images/secret-rotations-v2/mssql-credentials/mssql-credentials-parameters.png)
<ParamField path="Admin password" type="string" required>
SQL Server admin password
</ParamField>
- **Database Username 1** - the username of the first user that will be used for rotation.
- **Database Username 2** - the username of the second user that will be used for rotation.
<ParamField path="Host" type="string" required>
SQL Server host url (e.g., your-server.database.windows.net)
</ParamField>
5. Specify the secret names that the active credentials should be mapped to. Then click **Next**.
![Rotation Secrets Mapping](/images/secret-rotations-v2/mssql-credentials/mssql-credentials-secrets-mapping.png)
<ParamField path="Port" type="number" required>
Database port number (default: 1433)
</ParamField>
- **Username** - the name of the secret that the active username will be mapped to.
- **Password** - the name of the secret that the active password will be mapped to.
<ParamField path="Database" type="string" required>
Database name (default: master)
</ParamField>
6. Give your rotation a name and description (optional). Then click **Next**.
![Rotation Details](/images/secret-rotations-v2/mssql-credentials/mssql-credentials-details.png)
<ParamField path="Username1" type="string" required>
The first login name to rotate - `user-a`
</ParamField>
- **Name** - the name of the secret rotation configuration. Must be slug-friendly.
- **Description** (optional) - a description of this rotation configuration.
<ParamField path="Username2" type="string" required>
The second login name to rotate - `user-b`
</ParamField>
7. Review your configuration, then click **Create Secret Rotation**.
![Rotation Review](/images/secret-rotations-v2/mssql-credentials/mssql-credentials-confirm.png)
<ParamField path="CA" type="string">
Optional database certificate to connect with database
</ParamField>
8. Your **Microsoft SQL Server Credentials** are now available for use via the mapped secrets.
![Rotation Created](/images/secret-rotations-v2/mssql-credentials/mssql-credentials-created.png)
</Tab>
<Tab title="API">
To create a Microsoft SQL Server Credentials Rotation, make an API request to the [Create Microsoft SQL Server
Credentials Rotation](/api-reference/endpoints/secret-rotations/mssql-credentials/create) API endpoint.
</Step>
<Step title="Configure the output secret mapping">
When a secret rotation is successful, the updated values needs to be saved to an existing key(s) in your project.
### Sample request
<ParamField path="Environment" type="string" required>
The environment where the rotated credentials should be mapped to.
</ParamField>
```bash Request
curl --request POST \
--url https://us.infisical.com/api/v2/secret-rotations/mssql-credentials \
--header 'Content-Type: application/json' \
--data '{
"name": "my-mssql-rotation",
"projectId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"description": "my database credentials rotation",
"connectionId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"environment": "dev",
"secretPath": "/",
"isAutoRotationEnabled": true,
"rotationInterval": 30,
"rotateAtUtc": {
"hours": 0,
"minutes": 0
},
"parameters": {
"username1": "infisical_user_1",
"username2": "infisical_user_2"
},
"secretsMapping": {
"username": "MSSQL_DB_USERNAME",
"password": "MSSQL_DB_PASSWORD"
}
}'
```
<ParamField path="Secret Path" type="string" required>
The secret path where the rotated credentials should be mapped to.
</ParamField>
### Sample response
<ParamField path="Interval" type="number" required>
What interval should the credentials be rotated in days.
</ParamField>
<ParamField path="DB USERNAME" type="string" required>
Select an existing secret key where the rotated database username value should be saved to.
</ParamField>
<ParamField path="DB PASSWORD" type="string" required>
Select an existing select key where the rotated database password value should be saved to.
</ParamField>
</Step>
</Steps>
## FAQ
<AccordionGroup>
<Accordion title="Why can't we delete the other user when rotating?">
When a system has multiple nodes by horizontal scaling, redeployment doesn't happen instantly.
This means that when the secrets are rotated, and the redeployment is triggered, the existing system will still be using the old credentials until the change rolls out.
To avoid causing failure for them, the old credentials are not removed. Instead, in the next rotation, the previous user's credentials are updated.
</Accordion>
<Accordion title="Why do you need an admin account?">
The admin account is used by Infisical to update the credentials for `user-a` and `user-b`.
You don't need to grant all permissions for your admin account but rather just the permission to alter logins (ALTER ANY LOGIN).
</Accordion>
<Accordion title="How does this work with Azure SQL Database?">
When using Azure SQL Database, you'll need to:
1. Use the full server name as your host (e.g., your-server.database.windows.net)
2. Ensure your admin account is either the Azure SQL Server admin or an Azure AD account with appropriate permissions
3. Configure your Azure SQL Server firewall rules to allow connections from Infisical's IP addresses
</Accordion>
</AccordionGroup>
```bash Response
{
"secretRotation": {
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"name": "my-mssql-rotation",
"description": "my database credentials rotation",
"secretsMapping": {
"username": "MSSQL_DB_USERNAME",
"password": "MSSQL_DB_PASSWORD"
},
"isAutoRotationEnabled": true,
"activeIndex": 0,
"folderId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"connectionId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"createdAt": "2023-11-07T05:31:56Z",
"updatedAt": "2023-11-07T05:31:56Z",
"rotationInterval": 30,
"rotationStatus": "success",
"lastRotationAttemptedAt": "2023-11-07T05:31:56Z",
"lastRotatedAt": "2023-11-07T05:31:56Z",
"lastRotationJobId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"nextRotationAt": "2023-11-07T05:31:56Z",
"connection": {
"app": "mssql",
"name": "my-mssql-connection",
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a"
},
"environment": {
"slug": "dev",
"name": "Development",
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a"
},
"projectId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"folder": {
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"path": "/"
},
"rotateAtUtc": {
"hours": 0,
"minutes": 0
},
"lastRotationMessage": null,
"type": "mssql-credentials",
"parameters": {
"username1": "infisical_user_1",
"username2": "infisical_user_2"
}
}
}
```
</Tab>
</Tabs>

98
docs/documentation/platform/secret-rotation/overview.mdx
View File

@@ -6,44 +6,92 @@ description: "Learn how to set up automated secret rotation in Infisical."
## Introduction
Secret rotation is a process that involves updating secret credentials periodically to minimize the risk of their compromise.
Rotating secrets helps prevent unauthorized access to systems and sensitive data by ensuring that old credentials are replaced with new ones regularly.
Secret rotation is a security best practice that involves systematically updating credentials and access tokens at regular intervals to minimize the risk of compromise. By proactively replacing existing secrets with new ones, organizations reduce the potential impact of credential theft or leakage.
Rotated secrets may include, but are not limited to:
Examples of rotated secrets include:
1. API keys for external services;
2. Database credentials for various platforms.
- API keys and authentication tokens for cloud services and third-party integrations
- Database credentials across production, staging, and development environments
## Rotation Process
## How Rotation Works
The practice of rotating secrets is a systematic and interval-based operation, carried out in four fundamental phases.
Secret Rotation systematically replaces secrets at regular intervals while ensuring zero downtime for your applications. This overlapping lifecycle approach maintains continuous availability while enhancing your security posture.
### 1. Creation
### Visual Timeline
The system initiates the rotation process by either making an API call to an external service or generating a new secret value internally.
Upon successful creation, the system will temporarily have three versions of the secret:
```mermaid
gantt
title Credential Lifecycle (Interval = 30 days)
dateFormat YYYY-MM-DD
axisFormat %b %d
- **Current active secret**: The one currently in use.
- **Future active secret (pending)**: The newly created secret, awaiting validation.
- **Previous active secret**: The old secret, soon to be retired.
section Credentials 1
Active :active, a1, 2023-01-01, 30d
Inactive :done, i1, after a1, 30d
Revoked :crit, r1, after i1, 30d
### 2. Testing
section Credentials 2
Active :active, a2, 2023-01-31, 30d
Inactive :done, i2, after a2, 30d
Revoked :crit, r2, after i2, 30d
The newly generated secret is subjected to a verification process to ensure its validity and functionality.
This involves conducting checks or tests that simulate actual operations the secret would perform.
Only the current active and the future active (pending) secrets are considered operational at this stage, while the previous active secret remains in standby mode.
section Credentials 3
Active :active, a3, 2023-03-02, 30d
Inactive :done, i3, after a3, 30d
Revoked :crit, r3, after i3, 30d
```
### 3. Deletion
### Credential States
Post-verification, the system deactivates and deletes the previous active secret, leaving only the current and future active (pending) secrets in the system.
Each set of credentials transitions through three distinct states:
### 4. Activation
- **Active**: The primary credentials that will be used for new connections
- **Inactive**: These credentials are still valid but are no longer issued for new connections
- **Revoked**: Permanently invalidated and deleted from the system
Finally, the system promotes the future active (pending) secret to be the new current active secret. It then triggers necessary side effects, such as invoking webhooks and generating events, to notify other services of the change.
### Rotation Cycle Example (30-Day Interval)
Using a __30-Day__ rotation interval as an example, here's how the process unfolds:
1. __Day 0__
- `Credential set 1` is issued and set to **Active**
- Applications begin using this set for authentication
2. __Day 30__
- `Credential set 2` is issued and set to **Active**
- `Credential set 1` transitions to **Inactive** but remains valid
- New connections utilize set 2 while existing connections with set 1 continue to work
<Note>
This overlapping validity period ensures that at any point during the active period of a credential set, you are guaranteed that retrieved credentials will be valid for the specified rotation period.
</Note>
3. __Day 60__
- `Credential set 3` is issued and set to **Active**
- `Credential set 2` transitions to **Inactive** but remains valid
- `Credential set 1` is **Revoked** and securely deleted
- By now, all applications should have transitioned to using set 2 or 3
4. __Day 90__
- `Credential set 4` is issued and set to **Active**
- `Credential set 3` transitions to **Inactive** but remains valid
- `Credential set 2` is **Revoked** and securely deleted
- The cycle continues...
### Benefits of This Approach
- **Zero Downtime**: Applications always have valid credentials
- **Grace Period**: The inactive period gives applications time to update to new credentials
- **Reduced Risk**: Credentials are regularly cycled, limiting the impact of potential compromise
- **Predictable Schedule**: Makes credential management more systematic and easier to automate
### Implementation Considerations
- Choose a rotation interval appropriate for your security requirements and operational needs
- Ensure your applications can handle credential updates gracefully
- Monitor for applications still using credentials nearing revocation
## Infisical Secret Rotation Strategies
1. [SendGrid Integration](./sendgrid)
2. [PostgreSQL/CockroachDB Implementation](./postgres)
3. [MySQL/MariaDB Configuration](./mysql)
4. [AWS IAM User](./aws-iam)
- [PostgreSQL Credentials](./postgres)
- [Microsoft SQL Server Credentials](./mssql)

220
docs/documentation/platform/secret-rotation/postgres.mdx
View File

@@ -1,104 +1,158 @@
---
title: "PostgreSQL/CockroachDB"
description: "Learn how to automatically rotate PostgreSQL/CockroachDB user passwords."
title: "PostgreSQL Credentials"
description: "Learn how to automatically rotate PostgreSQL credentials."
---
The Infisical Postgres secret rotation allows you to automatically rotate your Postgres database user's password at a predefined interval.
## Prerequisites
1. Create a [PostgreSQL Connection](/integrations/app-connections/postgres) with the required **Secret Rotation** permissions
2. Create two designated database users for Infisical to rotate the credentials for. Be sure to grant each user login permissions for the desired database with the necessary privileges their use case will require.
An example creation statement might look like:
```SQL
-- first user
CREATE USER infisical_user_1 WITH ENCRYPTED PASSWORD 'temporary_password';
GRANT CONNECT ON DATABASE my_database TO infisical_user_1;
GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA public TO infisical_user_1;
-- second user
CREATE USER infisical_user_2 WITH ENCRYPTED PASSWORD 'temporary_password';
GRANT CONNECT ON DATABASE my_database TO infisical_role;
GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA public TO infisical_user_2;
```
<Tip>
To learn more about PostgreSQL's permission system, please visit their [documentation](https://www.postgresql.org/docs/current/sql-grant.html).
</Tip>
## Prerequisite
## Create a PostgreSQL Credentials Rotation in Infisical
1. Create two users with the required permission in your PostgreSQL instance. We'll refer to them as `user-a` and `user-b`.
2. Create another PostgreSQL user with just the permission to update the passwords of `user-a` and `user-b`. We'll refer to this user as the `admin` user.
<Tabs>
<Tab title="Infisical UI">
1. Navigate to your Secret Manager Project's Dashboard and select **Add Secret Rotation** from the actions dropdown.
![Secret Manager Dashboard](/images/secret-rotations-v2/generic/add-secret-rotation.png)
To learn more about Postgres permission system, please visit this [documentation](https://www.postgresql.org/docs/9.1/sql-grant.html).
2. Select the **PostgreSQL Credentials** option.
![Select PostgreSQL Credentials](/images/secret-rotations-v2/postgres-credentials/select-postgres-credentials-option.png)
3. Select the **PostgreSQL Connection** to use and configure the rotation behavior. Then click **Next**.
![Rotation Configuration](/images/secret-rotations-v2/postgres-credentials/postgres-credentials-configuration.png)
## How it works
- **PostgreSQL Connection** - the connection that will perform the rotation of the configured database user credentials.
- **Rotation Interval** - the interval, in days, that once elapsed will trigger a rotation.
- **Rotate At** - the local time of day when rotation should occur once the interval has elapsed.
- **Auto-Rotation Enabled** - whether secrets should automatically be rotated once the rotation interval has elapsed. Disable this option to manually rotate secrets or pause secret rotation.
1. Infisical connects to your database using the provided `admin` user account.
2. A random value is generated and the password for `user-a` is updated with the new value.
3. The new password is then tested by logging into the database
4. If test is success, it's saved to the output secret mappings so that rest of the system gets the newly rotated value(s).
5. The process is then repeated for `user-b` on the next rotation.
6. The cycle repeats until secret rotation is deleted/stopped.
4. Input the the usernames of the database roles created above that will be used for rotation. The click **Next**.
![Rotation Parameters](/images/secret-rotations-v2/postgres-credentials/postgres-credentials-parameters.png)
## Rotation Configuration
- **Database Username 1** - the username of the first user that will be used for rotation.
- **Database Username 2** - the username of the second user that will be used for rotation.
<Steps>
<Step title="Open Secret Rotation Page">
Head over to Secret Rotation configuration page of your project by clicking on `Secret Rotation` in the left side bar
</Step>
<Step title="Click on PostgresSQL card" />
5. Specify the secret names that the active credentials should be mapped to. Then click **Next**.
![Rotation Secrets Mapping](/images/secret-rotations-v2/postgres-credentials/postgres-credentials-secrets-mapping.png)
<Step title="Provide the inputs">
<ParamField path="Admin Username" type="string" required="true">
Rotator admin username
</ParamField>
- **Username** - the name of the secret that the active username will be mapped to.
- **Password** - the name of the secret that the active password will be mapped to.
<ParamField path="Admin password" type="string" required="true">
Rotator admin password
</ParamField>
6. Give your rotation a name and description (optional). Then click **Next**.
![Rotation Details](/images/secret-rotations-v2/postgres-credentials/postgres-credentials-details.png)
<ParamField path="Host" type="string" required="true">
Database host url
</ParamField>
- **Name** - the name of the secret rotation configuration. Must be slug-friendly.
- **Description** (optional) - a description of this rotation configuration.
<ParamField path="Port" type="number" required="true">
Database port number
</ParamField>
7. Review your configuration, then click **Create Secret Rotation**.
![Rotation Review](/images/secret-rotations-v2/postgres-credentials/postgres-credentials-confirm.png)
<ParamField path="Username1" type="string" required="true">
The first username of two to rotate - `user-a`
</ParamField>
8. Your **PostgreSQL Credentials** are now available for use via the mapped secrets.
![Rotation Created](/images/secret-rotations-v2/postgres-credentials/postgres-credentials-created.png)
</Tab>
<Tab title="API">
To create a PostgreSQL Credentials Rotation, make an API request to the [Create PostgreSQL
Credentials Rotation](/api-reference/endpoints/secret-rotations/postgres-credentials/create) API endpoint.
<ParamField path="Username2" type="string" required="true">
The second username of two to rotate - `user-b`
</ParamField>
<ParamField path="CA" type="string" optional>
Optional database certificate to connect with database
</ParamField>
</Step>
<Step title="Configure the output secret mapping">
### Sample request
When a secret rotation is successful, the updated values needs to be saved to an existing key(s) in your project.
```bash Request
curl --request POST \
--url https://us.infisical.com/api/v2/secret-rotations/postgres-credentials \
--header 'Content-Type: application/json' \
--data '{
"name": "my-pg-rotation",
"projectId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"description": "my database credentials rotation",
"connectionId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"environment": "dev",
"secretPath": "/",
"isAutoRotationEnabled": true,
"rotationInterval": 30,
"rotateAtUtc": {
"hours": 0,
"minutes": 0
},
"parameters": {
"username1": "infisical_user_1",
"username2": "infisical_user_2"
},
"secretsMapping": {
"username": "POSTGRES_DB_USERNAME",
"password": "POSTGRES_DB_PASSWORD"
}
}'
```
<ParamField path="Environment" type="string" required>
The environment where the rotated credentials should be mapped to.
</ParamField>
### Sample response
<ParamField path="Secret Path" type="string" required>
The secret path where the rotated credentials should be mapped to.
</ParamField>
<ParamField path="Interval" type="number" required>
What interval should the credentials be rotated in days.
</ParamField>
<ParamField path="DB USERNAME" type="string" required>
Select an existing secret key where the rotated database username value should be saved to.
</ParamField>
<ParamField path="DB PASSWORD" type="string" required>
Select an existing select key where the rotated database password value should be saved to.
</ParamField>
</Step>
</Steps>
## FAQ
<AccordionGroup>
<Accordion title="Why can't we delete the other user when rotating?">
When a system has multiple nodes by horizontal scaling, redeployment doesn't happen instantly.
This means that when the secrets are rotated, and the redeployment is triggered, the existing system will still be using the old credentials until the change rolls out.
To avoid causing failure for them, the old credentials are not removed. Instead, in the next rotation, the previous user's credentials are updated.
</Accordion>
<Accordion title="Why do you need root user account?">
The admin account is used by Infisical to update the credentials for `user-a` and `user-b`.
You don't need to grant all permission for your admin account but rather just the permissions to update both of the user's passwords.
</Accordion>
</AccordionGroup>
```bash Response
{
"secretRotation": {
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"name": "my-pg-rotation",
"description": "my database credentials rotation",
"secretsMapping": {
"username": "POSTGRES_DB_USERNAME",
"password": "POSTGRES_DB_PASSWORD"
},
"isAutoRotationEnabled": true,
"activeIndex": 0,
"folderId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"connectionId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"createdAt": "2023-11-07T05:31:56Z",
"updatedAt": "2023-11-07T05:31:56Z",
"rotationInterval": 30,
"rotationStatus": "success",
"lastRotationAttemptedAt": "2023-11-07T05:31:56Z",
"lastRotatedAt": "2023-11-07T05:31:56Z",
"lastRotationJobId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"nextRotationAt": "2023-11-07T05:31:56Z",
"connection": {
"app": "postgres",
"name": "my-pg-connection",
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a"
},
"environment": {
"slug": "dev",
"name": "Development",
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a"
},
"projectId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"folder": {
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"path": "/"
},
"rotateAtUtc": {
"hours": 0,
"minutes": 0
},
"lastRotationMessage": null,
"type": "postgres-credentials",
"parameters": {
"username1": "infisical_user_1",
"username2": "infisical_user_2"
}
}
}
```
</Tab>
</Tabs>

126
docs/integrations/app-connections/mssql.mdx Normal file
View File

@@ -0,0 +1,126 @@
---
title: "Microsoft SQL Server Connection"
description: "Learn how to configure a Microsoft SQL Server Connection for Infisical."
---
Infisical supports connecting to Microsoft SQL Server using database principals.
## Configure a Microsoft SQL Server Principal for Infisical
<Steps>
<Step title="Create a Principal">
Infisical recommends creating a designated server login and database user in your Microsoft SQL Server database for your connection.
```SQL
-- create server-level login
CREATE LOGIN infisical_login WITH PASSWORD = 'my-password';
-- create database-level user with login from above
USE my_database;
CREATE USER infisical_user FOR LOGIN infisical_login;
GRANT CONNECT TO infisical_user;
-- If you intend to use Platform Managed Credentials (see below)
GRANT ALTER ANY LOGIN TO infisical_login;
```
</Step>
<Step title="Grant Relevant Permissions">
Depending on how you intend to use your Microsoft SQL Server connection, you'll need to grant one or more of the following permissions.
<Tip>
To learn more about Microsoft SQL Server's permission system, please visit their [documentation](https://learn.microsoft.com/en-us/sql/t-sql/statements/grant-transact-sql?view=sql-server-ver16).
</Tip>
<Tabs>
<Tab title="Secret Rotation">
For Secret Rotations, your Infisical user will require the ability to alter other logins' passwords:
```SQL
GRANT ALTER ANY LOGIN TO infisical_login;
```
</Tab>
</Tabs>
</Step>
<Step title="Get Connection Details">
You'll need the following information to create your Microsoft SQL Server connection:
- `host` - The hostname or IP address of your Microsoft SQL Server server
- `port` - The port number your Microsoft SQL Server server is listening on (default: 1433)
- `database` - The name of the specific database you want to connect to
- `username` - The username of the login created in the steps above
- `password` - The password of the login created in the steps above
- `sslCertificate` (optional) - The SSL certificate required for connection (if configured)
</Step>
</Steps>
## Create Connection in Infisical
<Tabs>
<Tab title="Infisical UI">
1. Navigate to the App Connections tab on the Organization Settings page.
![App Connections Tab](/images/app-connections/general/add-connection.png)
2. Select the **Microsoft SQL Server Connection** option.
![Select Microsoft SQL Server Connection](/images/app-connections/mssql/select-mssql-connection.png)
3. Select the **Username & Password** method option and provide the details obtained from the previous section and press **Connect to Microsoft SQL Server**.
<Note>
Optionally, if you'd like Infisical to manage the credentials of this connection, you can enable the Platform Managed Credentials option.
If enabled, Infisical will update the password of the connection on creation to prevent external access to this database role.
</Note>
![Create Microsoft SQL Server Connection](/images/app-connections/mssql/create-username-and-password-method.png)
4. Your **Microsoft SQL Server Connection** is now available for use.
![Assume Role Microsoft SQL Server Connection](/images/app-connections/mssql/username-and-password-connection.png)
</Tab>
<Tab title="API">
To create a Microsoft SQL Server Connection, make an API request to the [Create PostreSQL
Connection](/api-reference/endpoints/app-connections/mssql/create) API endpoint.
<Note>
Optionally, if you'd like Infisical to manage the credentials of this connection, you can set the `isPlatformManagedCredentials` option to `true`.
If enabled, Infisical will update the password of the connection on creation to prevent external access to this database role.
</Note>
### Sample request
```bash Request
curl --request POST \
--url https://app.infisical.com/api/v1/app-connections/mssql \
--header 'Content-Type: application/json' \
--data '{
"name": "my-mssql-connection",
"method": "username-and-password",
"isPlatformManagedCredentials": true,
"credentials": {
"host": "123.4.5.6",
"port": 1433,
"database": "default",
"username": "infisical_login",
"password": "my-password",
},
}'
```
### Sample response
```bash Response
{
"appConnection": {
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"name": "my-pg-connection",
"version": 1,
"orgId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"createdAt": "2023-11-07T05:31:56Z",
"updatedAt": "2023-11-07T05:31:56Z",
"app": "mssql",
"method": "username-and-password",
"isPlatformManagedCredentials": true,
"credentials": {
"host": "123.4.5.6",
"port": 1433,
"database": "default",
"username": "infisical_login"
}
}
}
```
</Tab>
</Tabs>

7
docs/integrations/app-connections/overview.mdx
View File

@@ -74,4 +74,9 @@ in the UI or by passing the associated `connectionId` when generating resources
<Note>
Infisical is continuously expanding its third-party application support. If your desired application isn't listed,
you can still use previous methods of connecting to it such as our Native Integrations.
</Note>
</Note>
## Platform Managed Credentials
Some App Connections support the ability to have their credentials managed by Infisical. By enabling this option,
Infisical will modify the credentials to prevent external use of the configured access entity.

119
docs/integrations/app-connections/postgres.mdx Normal file
View File

@@ -0,0 +1,119 @@
---
title: "PostgreSQL Connection"
description: "Learn how to configure a PostgreSQL Connection for Infisical."
---
Infisical supports connecting to PostgreSQL using a database role.
## Configure a PostgreSQL Role for Infisical
<Steps>
<Step title="Create a Role">
Infisical recommends creating a designated role in your PostgreSQL database for your connection.
```SQL
-- create user role
CREATE ROLE infisical_role WITH LOGIN PASSWORD 'my-password'
-- grant login access to the specified database
GRANT CONNECT ON DATABASE my_database TO infisical_role;
```
</Step>
<Step title="Grant Relevant Permissions">
Depending on how you intend to use your PostgreSQL connection, you'll need to grant one or more of the following permissions.
<Tip>
To learn more about PostgreSQL's permission system, please visit their [documentation](https://www.postgresql.org/docs/current/sql-grant.html).
</Tip>
<Tabs>
<Tab title="Secret Rotation">
For Secret Rotations, your Infisical user will require the ability to alter other users' passwords:
```SQL
ALTER ROLE infisical_role WITH CREATEROLE;
```
</Tab>
</Tabs>
</Step>
<Step title="Get Connection Details">
You'll need the following information to create your PostgreSQL connection:
- `host` - The hostname or IP address of your PostgreSQL server
- `port` - The port number your PostgreSQL server is listening on (default: 5432)
- `database` - The name of the specific database you want to connect to
- `username` - The role name of the login created in the steps above
- `password` - The role password of the login created in the steps above
- `sslCertificate` (optional) - The SSL certificate required for connection (if configured)
</Step>
</Steps>
## Create Connection in Infisical
<Tabs>
<Tab title="Infisical UI">
1. Navigate to the App Connections tab on the Organization Settings page.
![App Connections Tab](/images/app-connections/general/add-connection.png)
2. Select the **PostgreSQL Connection** option.
![Select PostgreSQL Connection](/images/app-connections/postgres/select-postgres-connection.png)
3. Select the **Username & Password** method option and provide the details obtained from the previous section and press **Connect to PostgreSQL**.
<Note>
Optionally, if you'd like Infisical to manage the credentials of this connection, you can enable the Platform Managed Credentials option.
If enabled, Infisical will update the password of the connection on creation to prevent external access to this database role.
</Note>
![Create PostgreSQL Connection](/images/app-connections/postgres/create-username-and-password-method.png)
4. Your **PostgreSQL Connection** is now available for use.
![Assume Role PostgreSQL Connection](/images/app-connections/postgres/username-and-password-connection.png)
</Tab>
<Tab title="API">
To create a PostgreSQL Connection, make an API request to the [Create PostgreSQL
Connection](/api-reference/endpoints/app-connections/postgres/create) API endpoint.
<Note>
Optionally, if you'd like Infisical to manage the credentials of this connection, you can set the `isPlatformManagedCredentials` option to `true`.
If enabled, Infisical will update the password of the connection on creation to prevent external access to this database role.
</Note>
### Sample request
```bash Request
curl --request POST \
--url https://app.infisical.com/api/v1/app-connections/postgres \
--header 'Content-Type: application/json' \
--data '{
"name": "my-pg-connection",
"method": "username-and-password",
"isPlatformManagedCredentials": true,
"credentials": {
"host": "123.4.5.6",
"port": 5432,
"database": "default",
"username": "infisical_role",
"password": "my-password",
},
}'
```
### Sample response
```bash Response
{
"appConnection": {
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"name": "my-pg-connection",
"version": 1,
"orgId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"createdAt": "2023-11-07T05:31:56Z",
"updatedAt": "2023-11-07T05:31:56Z",
"app": "postgres",
"method": "username-and-password",
"isPlatformManagedCredentials": true,
"credentials": {
"host": "123.4.5.6",
"port": 5432,
"database": "default",
"username": "infisical_role"
}
}
}
```
</Tab>
</Tabs>

15
docs/internals/permissions/project-permissions.mdx
View File

@@ -187,12 +187,15 @@ Supports conditions and permission inversion
#### Subject: `secret-rotation`
| Action | Description |
| -------- | ------------------------------------- |
| `read` | View secret rotation policies |
| `create` | Set up automatic secret rotation |
| `edit` | Modify rotation schedules or policies |
| `delete` | Remove rotation policies |
Supports conditions and permission inversion
| Action | Description |
| ------------------------------ | ---------------------------------------------- |
| `read` | View secret rotation configurations |
| `read-generated-credentials` | View the generated credentials of a rotation |
| `create` | Set up secret rotation configurations |
| `edit` | Modify secret rotation configurations |
| `rotate-secrets` | Rotate the generated credentials of a rotation |
| `delete` | Remove secret rotation configurations |
#### Subject: `secret-syncs`

9
docs/mint.json
View File

@@ -177,11 +177,8 @@
"group": "Secret Rotation",
"pages": [
"documentation/platform/secret-rotation/overview",
"documentation/platform/secret-rotation/sendgrid",
"documentation/platform/secret-rotation/postgres",
"documentation/platform/secret-rotation/mysql",
"documentation/platform/secret-rotation/mssql",
"documentation/platform/secret-rotation/aws-iam"
"documentation/platform/secret-rotation/mssql"
]
},
{
@@ -419,7 +416,9 @@
"integrations/app-connections/databricks",
"integrations/app-connections/gcp",
"integrations/app-connections/github",
"integrations/app-connections/humanitec"
"integrations/app-connections/humanitec",
"integrations/app-connections/mssql",
"integrations/app-connections/postgres"
]
}
]

8
docs/self-hosting/configuration/envars.mdx
View File

@@ -439,6 +439,14 @@ When set, all visits to the Infisical login page will automatically redirect use
information.
</Accordion>
## External Database Connections
<ParamField query="DB_SSL_REJECT_UNAUTHORIZED" type="boolean" default="true" optional>
Whether external database connections should reject unauthorized SSL certificates. Only set this to `false` if
the database you are connecting to is within your internal network.
</ParamField>
## App Connections
You can configure third-party app connections for re-use across Infisical Projects.

53
frontend/src/components/secret-rotations-v2/SecretRotationV2Select.tsx
View File

@@ -1,7 +1,6 @@
import { faWrench } from "@fortawesome/free-solid-svg-icons";
import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
import { createNotification } from "@app/components/notifications";
import { Spinner, Tooltip } from "@app/components/v2";
import { SECRET_ROTATION_MAP } from "@app/helpers/secretRotationsV2";
import { SecretRotation, useSecretRotationV2Options } from "@app/hooks/api/secretRotationsV2";
@@ -56,58 +55,6 @@ export const SecretRotationV2Select = ({ onSelect }: Props) => {
</button>
);
})}
{/* templates for kubecon, remove once implemented */}
{[
{
name: "MySQL Credentials",
image: "MySql.png"
},
{
name: "SendGrid API Key",
image: "SendGrid.png"
},
{
name: "AWS IAM User Credentials",
image: "Amazon Web Services.png"
}
].map(({ name, image }) => {
let size: number;
switch (name) {
case "MySQL Credentials":
size = 80;
break;
case "SendGrid API Key":
size = 50;
break;
default:
size = 45;
}
return (
<button
type="button"
key={name}
onClick={() =>
createNotification({
type: "info",
text: `${name} Rotation is under development. Please check back soon.`
})
}
className="group relative flex h-28 cursor-pointer flex-col items-center justify-center rounded-md border border-mineshaft-600 bg-mineshaft-700 p-4 duration-200 hover:bg-mineshaft-600"
>
<img
src={`/images/integrations/${image}`}
width={size}
className="mt-auto"
alt={`${name} logo`}
/>
<div className="mt-auto max-w-xs text-center text-xs font-medium text-gray-300 duration-200 group-hover:text-gray-200">
{name}
</div>
</button>
);
})}
<Tooltip
side="bottom"
className="max-w-sm py-4"

12
frontend/src/components/secret-rotations-v2/ViewSecretRotationV2GeneratedCredentials/ViewSecretRotationV2GeneratedCredentials.tsx
View File

@@ -41,13 +41,21 @@ const Content = ({ secretRotation }: ContentProps) => {
);
}
if (!generatedCredentialsResponse) {
return (
<div className="flex w-full justify-center">
<p className="text-sm text-red">No generated credentials found for this rotation.</p>
</div>
);
}
let Component: ReactNode;
switch (generatedCredentialsResponse!.type) {
switch (generatedCredentialsResponse.type) {
case SecretRotation.PostgresCredentials:
case SecretRotation.MsSqlCredentials:
Component = (
<ViewSqlRotationGeneratedCredentials
generatedCredentialsResponse={generatedCredentialsResponse!}
generatedCredentialsResponse={generatedCredentialsResponse}
/>
);
break;

21
frontend/src/pages/secret-manager/SecretDashboardPage/components/SnapshotView/SnapshotView.tsx
View File

@@ -33,13 +33,11 @@ type Props = {
const LOADER_TEXT = ["Fetching your snapshot", "Creating the difference view"];
const deepCompareSecrets = (lhs: SecretV3RawSanitized, rhs: SecretV3RawSanitized) =>
lhs.isRotatedSecret ||
rhs.isRotatedSecret ||
(lhs.key === rhs.key &&
lhs.value === rhs.value &&
lhs.comment === rhs.comment &&
lhs?.valueOverride === rhs?.valueOverride &&
JSON.stringify(lhs.tags) === JSON.stringify(rhs.tags));
lhs.key === rhs.key &&
lhs.value === rhs.value &&
lhs.comment === rhs.comment &&
lhs?.valueOverride === rhs?.valueOverride &&
JSON.stringify(lhs.tags) === JSON.stringify(rhs.tags);
export const SnapshotView = ({
snapshotId,
@@ -100,9 +98,12 @@ export const SnapshotView = ({
const doesExist = Boolean(secretGroupById?.[id]);
if (doesExist) {
diffView.push({
mode: deepCompareSecrets(rollSecret, secretGroupById[id])
? TDiffModes.NoChange
: TDiffModes.Modified,
mode:
rollSecret.isRotatedSecret ||
secretGroupById[id]?.isRotatedSecret ||
deepCompareSecrets(rollSecret, secretGroupById[id])
? TDiffModes.NoChange
: TDiffModes.Modified,
pre: secretGroupById[id],
post: rollSecret
});

6
frontend/src/pages/secret-manager/SecretRotationPage/SecretRotationPage.tsx
View File

@@ -141,7 +141,7 @@ const Page = () => {
</PageHeader>
<NoticeBannerV2 title="Secret Rotations Update">
<p className="text-sm text-bunker-200">
Infisical is revamping it&#39;s Secret Rotation experience.
Infisical is revamping its Secret Rotation experience.
</p>
<p className="mt-2 text-sm text-bunker-200">
Secret Rotations can now be created from the{" "}
@@ -364,7 +364,7 @@ const Page = () => {
<ModalContent className="max-w-5xl" title="Secret Rotation Update">
<div className="flex flex-col gap-2">
<p className="text-mineshaft-200">
Infisical is revamping it&#39;s Secret Rotation experience. Navigate to the{" "}
Infisical is revamping its Secret Rotation experience. Navigate to the{" "}
<Link
className="text-mineshaft-100 underline decoration-primary underline-offset-2 hover:text-mineshaft-200"
to={`/${ProjectType.SecretManager}/$projectId/overview` as const}
@@ -372,7 +372,7 @@ const Page = () => {
>
Secret Manager Dashboard
</Link>{" "}
to create a Secret Rotations.
to create a Secret Rotation.
</p>
<div className="overflow-clip rounded border border-mineshaft-600">
<img