Scalable and automated secret management
A secret (e.g. a password, key, certificate) is automatically generated by a system. For example, at the time of deployment of a computing machine, a password may be generated and securely stored by the system with other secrets. The password may be used by the system to perform various operations (e.g. configuring the machine, . . . ). When a secret is requested by a user to access a resource, a secret is provided to the user. Once the secret has been utilized by the user, the secret is reset and replaced with a newly generated secret. All/portion of the secrets may also be automatically regenerated. For example, when a breach occurs and/or is suspected, each of the secrets may be replaced with newly generated secrets and securely stored. Auditing and reporting may also be provided (e.g. each request/access to a secret is logged).
1. A method for secret management, comprising: automatically generating a first secret used to access a resource; securely storing the first secret with other secrets; determining when a request is made from a user for the first secret; providing the first secret to access the resource a single time; determining when the first secret has expired; determining when the user is authorized to access the resource by using a lock-box to analyze a plurality of predefined conditions, wherein the lock-box evaluates user authorization at predetermined intervals, wherein using a lock-box that analyzes a plurality of predefined conditions, further comprises revoking the user authorization to access the resource; automatically generating a second secret to replace the first secret in response to determining that the first secret has expired and the user is authorized to access the resource; and replacing the first secret with the second secret.
2. The method of claim 1 , further comprising logging each request and use of the secrets.
3. The method of claim 1 , wherein determining when the first secret has expired comprises determining when an operation involving the resource has been completed.
4. The method of claim 1 , wherein determining when the first secret has expired comprises determining when the first secret has been used to log into a machine.
5. The method of claim 1 , further comprising automatically replacing at least a portion of the stored secrets with automatically generated replacement secrets.
6. The method of claim 1 , further comprising generating a first secret for each machine in a service upon deployment of the machine in the service.
7. The method of claim 1 , wherein the first secret is used a single time and then automatically replaced with the second secret.
8. A computer-readable storage device storing computer-executable instructions for secret management, comprising:
automatically generating a first secret used to access a resource;
securely storing the first secret with other secrets;
determining when a request is made from a user for the first secret; providing the first secret to access the resource a single time;
determining when the first secret has expired;
determining when the user is authorized to access the resource by using a lock-box that analyzes a plurality of predefined conditions, wherein the lock-box evaluates user authorization at predetermined intervals, wherein using a lock-box that analyzes a plurality of predefined conditions, further comprises revoking the user authorization to access the resource;
automatically generating a second secret to replace the first secret in response to determining at least one of: the first secret has expired and the user is authorized to have access to the resource; and
replacing the first secret with the second secret.
9. The computer-readable storage device of claim 8 , further comprising logging each request and use of the secrets.
10. The computer-readable storage device of claim 8 , wherein generating the second secret comprises determining when the user has accessed the resource.
11. The computer-readable storage device of claim 8 , wherein determining when the first secret has expired comprises determining when an operation involving the resource has been completed.
12. The computer-readable storage device of claim 8 , further comprising automatically replacing at least a portion of the stored secrets with automatically generated replacement secrets in response to a determined security breach.
13. The computer-readable storage device of claim 8 , further comprising generating a first secret for each machine in a service upon deployment of the machine in the service.
14. The computer-readable storage device of claim 8 , wherein the first secret is used a single time and then automatically replaced with the second secret.
15. A system for secret management, comprising:
a processor and a memory;
an operating environment executing using the processor; and
a secret manager that is configured to perform actions comprising:
automatically generating a first secret used to access a resource;
securely storing the first secret with other secrets;
determining when a request is made from a user for the first secret;
providing the first secret to access the resource a single time;
determining when the first secret has expired;
determining when the user is authorized to access the resource by using a lock-box that analyzes a plurality of predefined conditions, wherein the lock-box evaluates user authorization at predetermined intervals, wherein using a lock-box that analyzes a plurality of predefined conditions, further comprises revoking the user authorization to access the resource;
automatically generating a second secret to replace the first secret in response to determining at least one of: the first secret has expired and the user is authorized to have access to the resource; and
replacing the first secret with the second secret.
16. The system of claim 15 , further comprising logging each request and use of the secrets.
17. The system of claim 15 , wherein generating the second secret comprises determining when the user has accessed the resource.
18. The system of claim 15 , wherein determining when the first secret has expired comprises determining when an operation involving the resource has been completed.
19. The method of claim 1 , wherein using a lock-box that analyzes a plurality of predefined conditions, further comprises assigning an expiration interval to the user authorization.