Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Sanitize private_key from returned db plugin config #10416

Merged
merged 1 commit into from
Nov 19, 2020

Conversation

tomhjp
Copy link
Contributor

@tomhjp tomhjp commented Nov 18, 2020

If you go through the docs for setting up mongodbatlas-database-plugin, and then run vault read database/config/my-mongodbatlas-database, you'll get the following:

vault read database/config/my-mongodbatlas-database
Key                                   Value
---                                   -----
allowed_roles                         [my-role]
connection_details                    map[private_key:ea6acbc7-8a30-4a3f-812e-6f869c08bcd1 project_id:4f96cad208574fd14aa8dda3a public_key:jmskfortvf]
password_policy                       n/a
plugin_name                           mongodbatlas-database-plugin
root_credentials_rotate_statements    []

The private_key is a sensitive value that should not be printed back out.

We already sanitize password for all DB plugins, including in the connection URL, and that covers the sensitive information for all other builtin database plugins. The only exception is hashicorp/vault-plugin-database-mongodbatlas. While we should provide a mechanism for non-builtin plugins to specify config fields as sensitive, this one-liner fix at least shores up the last of the builtin plugins.

@tomhjp tomhjp merged commit c843aa6 into master Nov 19, 2020
@tomhjp tomhjp deleted the sanitize-private-key branch November 19, 2020 10:58
tomhjp added a commit that referenced this pull request Nov 20, 2020
I forgot to add this along with the original PR and it seems worthy of a changelog entry to me.
tomhjp added a commit that referenced this pull request Dec 1, 2020
tomhjp added a commit that referenced this pull request Dec 1, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants