I learned of the existence of steampipe recently, which seems to be an interesting tool to help teams - including cybersecurity teams - understand their cloud assets and ensure compliance with security policies.
I started playing around with it, and one thing that struck me immediately is the need to store API credentials for the various plugins in plaintext in JSON files in your user profile. This struck me as incredibly insecure, especially given that the default UNIX permissions on the files seem to be 644.
Does anyone know if there is a way to store and dynamically retrieve these API credentials more securely, such as in a remote key store like AWS Secrets Manager or Azure Key Vault? I spent awhile searching and watching some YouTube videos, but didn’t come across a method to do this.
Sorry I’m new to lemmy, didn’t see the screenshot, Yea if it’s static creds locally I would use something simple like 1pass or sops and just make a wrapper to pull the data (after authenticating) and populate the needed environment variables. But if you have multiple connections with the same plugin it won’t work. So you need to get creative on setting up per connection settings. Usually for that it’s still stored in a secure storage but the config is rendered on startup using some simple bash or templating. The real advantage of steampipe for me is the aggregated connections, searching all Aws accounts for a resource Or dumping all r53 records with a simple query is a godsend. And adding tooling like redash make it even easier to drill down and share data