Drone amazon secret plugin

israelp · November 12, 2020, 8:58am

Are secret passing in transit between the drone-amazon-plugin and the drone runner are being encrytped by the given token, or some other way ?

csgitharness · November 12, 2020, 12:00pm

Yes! the secret passed are encrypted with the token provided, refer https://docs.drone.io/secret/encrypted/

bradrydzewski · November 12, 2020, 2:36pm

I just wanted to follow up and provide more detail. When you use a secret extension, secrets are encrypted in-transit using aesgcm. This ensures payloads are encrypted even if you do not have https setup. You can audit the relevant code here:

github.com

drone/drone-go/blob/master/plugin/secret/handler.go#L95:L110


	secret, err := p.plugin.Find(r.Context(), req)
	if err != nil {
		p.logger.Debugf("secrets: cannot find secret %s: %s", req.Name, err)
		http.Error(w, err.Error(), http.StatusNotFound)
		return
	}
	out, _ := json.Marshal(secret)
	// If the client can optionally accept an encrypted
	// response, we encrypt the payload body using secretbox.
	if r.Header.Get("Accept-Encoding") == "aesgcm" {
		key, err := aesgcm.Key(p.secret)
		if err != nil {
			p.logger.Errorf("secrets: invalid encryption key: %s", err)
			http.Error(w, err.Error(), http.StatusInternalServerError)
			return
		}
		out, err = aesgcm.Encrypt(out, key)
		if err != nil {
			p.logger.Errorf("secrets: cannot encrypt message: %s", err)
			http.Error(w, err.Error(), http.StatusInternalServerError)

israelp · November 12, 2020, 6:27pm

Thanks, for the response, where can I see the runner code that send the “aesgcm” header ?

israelp · November 17, 2020, 4:13pm

After some investigation, our drone runner is not sending “aesgcm” as Accept-Encoding header, its sending “identity”, so our secrets are not encrypted by the drone amazon-secret-plugin.
What configuration should we change in the runner/drone-server for it to use “aesgcm” ?
Thanks

israelp · May 18, 2021, 9:51am

Is there a way to make sure drone runner <-> amazon secrets plugin encrypt secrets at transit ?