Skip to content

Rotating secrets

Jump to bottom
David McDonald edited this page Mar 4, 2020 · 10 revisions

API key for our apps to talk to our API

For our applications to talk our API they must use one of the API keys found in API_INTERNAL_SECRETS in credentials/<env>/paas/environment_variables. If you want to rotate these keys then you should:

  1. Add the new secret to API_INTERNAL_SECRETS in credentials/<env>/paas/environment_variables
  2. Deploy the API so it now allows apps to auth with the new secret
  3. Change ADMIN_CLIENT_SECRET in credentials/<env>/paas/environment_variables and credentials/<env>/document-download/paas-environment to be the new secret
  4. Deploy document-download-frontend and the admin app
  5. Remove the old secret from API_INTERNAL_SECRETS in credentials/<env>/paas/environment_variables
  6. Deploy the API to preview and then run functional tests for all the other apps (antivirus, document download etc) to check they can still talk to the API. If so, you can then continue to deploy the API to production

API key for our apps to talk to document download API

For our applications to talk to the document download API they must use one of the API keys found in AUTH_TOKENS in credentials/<env>/document-download/paas-environment. If you want to rotate these keys then you should:

  1. Add the new secret to AUTH_TOKENS in credentials/<env>/document-download/paas-environment using a : separated list, for example secret1:secret2
  2. Deploy the document download API so it now allows apps to auth with the new secret
  3. Change DOCUMENT_DOWNLOAD_API_KEY in credentials/<env>/paas/environment_variables and credentials/functional-tests/<env>-functional to be the new secret
  4. Deploy the API
  5. Remove the old secret from AUTH_TOKENS in credentials/<env>/document-download/paas-environment
  6. Deploy the document download API to preview and then run functional tests for all the other apps (admin, api, document download, antivirus) to check they can still talk to the document download API. If so, you can then continue to deploy the document download API to production

API key for our apps to talk to template preview

For our applications to talk to the template preview they must use one of the API keys found in TEMPLATE_PREVIEW_INTERNAL_SECRETS in credentials/<env>/paas/environment_variables. If you want to rotate these keys then you should:

  1. Add the new secret to TEMPLATE_PREVIEW_INTERNAL_SECRETS in credentials/<env>/paas/environment_variables
  2. Deploy template preview so it now allows apps to auth with the new secret
  3. Change TEMPLATE_PREVIEW_API_KEY in credentials/<env>/paas/environment_variables
  4. Deploy the API and the admin apps
  5. Remove the old secret from TEMPLATE_PREVIEW_INTERNAL_SECRETS in credentials/<env>/paas/environment_variables
  6. Deploy template preview to preview and then run functional tests for the admin app and api to check they can still talk to template preview. If so, you can then continue to deploy template preview to production
Clone this wiki locally