Toxic Repo
• Julian Simpson
If you can’t dispose of toxic waste (say, by burning it or launching it into space using surplus ICBM’s), then you probably need to contain it: stop innocents from stumbling across it, or stop the malicious from using it for malicious projects.
The same issues apply to your source tree. If you have Amazon Web Services credentials checked into a project on GitHub, that’s a toxic repo. You’ll want to contain to protect people from intentionally or unintentionally damaging the resources that can be accessed from the credentials.
One of the problems of having your own toxic waste dump, is that it’s very easy to add more waste to the pile. So that repo with a private key checked in might easily get an AWS credential, and a couple of months later, a raw database password.
Another is that sometimes, you might give the wrong people access.
What can you do about it?
- Amazon’s IAM is incredibly useful at containing the material inside Amazon itself. Use things like that.
- Be prepared to burn credentials if they are compromised.
- Rotating any toxic credentials stored in a repo also helps.
Cleaning up some toxic waste yesterday was pretty good. That’s one less dirty secret.