bytechefhq / bytechefhq/bytechef
[feature]: Support for securely storing and obtaining data in external secret store/vault
- Dominant language
- Java
- Stars
- 1k
- Forks
- 170
- Avg merge
- 11h 25m
- Merged PRs (30d)
- 115
Description
The majority of tasks that represent connectors for various services require authorization to use those services.
Credentials need to be securely stored inside the database in the `connection` table. To achieve this, all credential data needs to be encrypted with a key. Each workflow task definition that requires credentials should define a reference(unique name used when storing credentials in the database) to credentials stored inside the database. This way, any sensitive data will not be exposed, and workflow definitions become easily shareable.
The engine needs to have support for obtaining the encryption key through the following strategies:
- [x] File-based
The workflow engine automatically creates a random encryption key on the first launch and saves it in the ~/.bytechef folder. That key encrypts the credentials before they are saved to the database.
- [x ] Environment variables
The engine needs to have support for obtaining credentials through the following strategies:
- [ ] AWS Key Management service - https://aws.amazon.com/kms/
- [ ] Google Cloud Key Management - https://cloud.google.com/security-key-management
- [ ] Azure Vault - https://azure.microsoft.com/en-us/services/key-vault/
- [ ] HashiCorp - https://www.vaultproject.io/
Contributor guide
Assessment
This issue has not been assessed yet.