Configuration of multiple secrets
Techniques are described for managing secrets for accessing resources of a computing service provider by a client computing device. Two secrets are created that are valid for accessing the resource by the client computing device. When one of the two secrets are invalid for accessing the resource, the client computing device can use the second of the two secrets to gain access to the resource.
1. A method of managing secrets for accessing a secured resource or service of a computing service provider by a client, the method comprising:
establishing, by the computing service provider, a first secret and a second secret that are both valid for securely accessing the resource or service at the computing service provider;
configuring a client to access the resource or service at the computing service provider using a set of valid secrets including the first secret and the second secret, wherein either of the first secret and the second secret are usable by the client to access the resource or service at the computing service provider and at least two secrets are maintained in the set of valid secrets;
receiving, by the computing service provider from the client, the first secret;
granting, to the client by the computing service provider, access to the resource or service at the computing service provider based on authentication of the first secret;
revoking, by the computing service provider, the first secret as a valid secret for accessing the resource or service at the computing service provider, while continuing to maintain at least two secrets in the set of valid secrets;
receiving, by the computing service provider from the client, the second secret; and
granting, by the computing service provider, access to the resource or service at the computing service provider based on authentication of the second secret;
wherein:
the computing service provider is configured to grant, for the resource or service at the computing service provider, access to the resource or service responsive to receiving any arbitrary secret included in the set of valid secrets; and
each of the secrets included in the set of valid secrets are secrets of a same type for providing a single entity with a same access to the resource or service at the computing service provider.
2. The method of claim 1 , further comprising:
establishing, by the computing service provider, a third secret that is valid for accessing the resource or service at the computing service provider; and
configuring the client to access the resource or service at the computing service provider using both the third secret and the second secret.
3. The method of claim 1 , further comprising:
receiving, by the computing service provider from the client, a notification that the client was unable to access the resource or service at the computing service provider using the first secret.
4. The method of claim 1 , wherein the first and second secrets are one or more of passwords, SSH keys, or certificates.
5. The method of claim 1 , wherein the client rotates between at least two valid secrets for accessing the resource or service at the computing service provider.
6. The method of claim 1 , wherein the resource or service at the computing service provider is a database service.
7. The method of claim 1 , further comprising configuring the client to access the resource or service at the computing service provider using three or more secrets that are operable for accessing the resource or service at the computing service provider.
8. A system comprising:
a memory storing thereon instructions that when executed by a processor of the system, cause the system to perform operations comprising:
receiving, from a computing service provider, two secrets that are operable for accessing a resource at the computing service provider, wherein the resource at the computing service provider is accessible using a set of valid secrets including the two secrets and wherein at least two secrets are maintained in the set of valid secrets;
accessing the resource at the computing service provider at a first time, based on authentication of the first of the two secrets;
accessing the resource at the computing service provider at a second time, based on authentication of the second of the two secrets;
in response to a request to access the resource at the computing service provider at a third time using the first of the two secrets, receiving, from the computing service provider, an indication that the first of the two secrets is not valid for accessing the resource at the computing service provider;
sending, to the computing service provider, a notification that the resource at the computing service provider was not accessible using the first of the two secrets;
receiving, from the computing service provider, a third secret that is operable to access the resource at the computing service provider;
adding additional secrets to maintain at least two secrets in the set of valid secrets; and
accessing the resource at the computing service at a subsequent time, based on authentication of the third secret or the second secret;
wherein:
the computing service provider is configured to grant, for the resource at the computing service provider, access to the resource responsive to receiving any arbitrary secret included in the set of valid secrets; and
each of the secrets included in the set of valid secrets are secrets of a same type for providing a single entity with a same access to the resource at the computing service provider.
9. The system of claim 8 , wherein the secrets are one or more of passwords, SSH keys, or certificates.
10. The system of claim 8 , further comprising rotating between at least two valid secrets for accessing the resource at the computing service provider.
11. The system of claim 8 , wherein the resource at the computing service provider is a database service.
12. The system of claim 8 , further comprising instructions that when executed by a processor of the system, cause the system to perform operations comprising:
accessing the resource at the computing service provider using three or more secrets that are operable for accessing the resource at the computing service provider.
13. The system of claim 8 , further comprising instructions that when executed by a processor of the system, cause the system to perform operations comprising:
accessing the resource at the computing service provider using all valid secrets on a regular basis to access the resource at the computing service provider.
14. The system of claim 13 , wherein the valid secrets are alternated.
15. The system of claim 13 , wherein the valid secrets are selected at random.
16. The system of claim 8 , further comprising instructions that when executed by a processor of the system, cause the system to perform operations comprising:
attempting to access the resource at the computing service provider using the first of the two secrets on a periodic basis.
17. A computer-readable storage medium having computer-executable instructions stored thereupon which, when executed by one or more processors of a computing device, cause the computing device to perform operations comprising:
establishing two secrets that are valid for accessing a resource;
configuring a client computing device to access the resource using a set of valid secrets including both of the two secrets and at least two secrets are maintained in the set of valid secrets;
receiving, from the client computing device, a first of the two secrets;
granting access to the resource based on authentication of the first of the two secrets;
revoking the first of the two secrets as valid for accessing the resource;
subsequently continuing to maintain at least two secrets in the set of valid secrets;
receiving, from the client computing device, a second of the two secrets; and
granting access to the resource based on authentication of the second of the two secrets;
wherein:
the client computing device is granted access to the resource in response to receiving any arbitrary secret included in the set of valid secrets; and
each of the secrets included in the set of valid secrets are secrets of a same type for providing a single entity with a same access to the resource.
18. The computer-readable storage medium of claim 17 , further comprising computer-executable instructions stored thereupon which, when executed by one or more processors of a computing device, cause the computing device to perform operations comprising:
establishing a third secret that is valid for accessing the resource; and
configuring the client computing device to access the resource using both the third secret and the second of the two secrets.
19. The computer-readable storage medium of claim 17 , further comprising computer-executable instructions stored thereupon which, when executed by one or more processors of a computing device, cause the computing device to perform operations comprising:
receiving, from the client computing device, a notification that the client computing device was unable to access the resource using the first of the two secrets.
20. The computer-readable storage medium of claim 17 , further comprising computer-executable instructions stored thereupon which, when executed by one or more processors of a computing device, cause the computing device to perform operations comprising:
configuring the client computing device to access the resource using three or more secrets that are operable for accessing the resource.