Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

In a situation where you're deploying nodes (e.g. amazon ec2), what are the recommended best practices for securing things like credentials to other resources? Without solving for scale, we might manually type passwords into configuration files, put ssh keys in place, etc.

When we attempt to solve for scale by introducing automation via build scripts and/or tools to spin up new ec2 nodes, etc, we run into all sorts of headaches (admittedly, some perhaps unnecessary).

Here are our priorities

  • automated deployment of new nodes (which need ssh keys)
  • automated deployment of application code (which utilize things like database credentials)
  • not storing any credentials in revision control (I don't trust revision control security)
  • as few people have access to production credentials as possible, even developers (they have their own credentials for accessing resources)

I specifically mention database credentials, but credentials to anything from revision control to ssh keys are relevant.

We've come up with a handful of solutions, each with their own pros and cons, but figure this problem must have already been solved by several people. Are we overthinking the problem?

If it's relevant, here is some information about our environment and tools

  • linux
  • capistrano
  • puppet
  • java, ruby, php
  • atlassian's bamboo
  • ssh keys
  • mysql, postgres, activemq
share|improve this question

If you are looking for a secure way to store this data (encrypted?) without user interaction: there is none!

share|improve this answer

You could use a standardized EC2-image for the deployment of every node. Then you could use bash logging in and changing all passwords then saving it somewhere.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.