Working with sensitive data

Tengri includes a specialized mechanism for the secure storage of sensitive data — secrets (passwords, API keys, access tokens and other credentials) — and their secure use within code.

The main advantage of this feature is security. The value of a secret is stored in encrypted form just once. It is substituted on the server side directly during the execution of a request and is never displayed in the platform interface again.

Secrets are managed in the Settings > Secrets tab.

For security reasons, the value of a saved secret cannot be viewed or copied from the interface once it has been created.

How it works

The user creates a secret via the graphical interface, assigning it a unique name (identifier) and a value. Once saved, this secret can be referenced in the code by its identifier using the special secret function.

Syntax: secret('identifier')

Example

Let’s define three secrets for accessing AWS storage via the graphical interface.

Tengri interface for working with secrets

Now let’s use the secret function to set the access parameters for the AWS storage, without exposing the secrets in the code.

import boto3

s3_client = boto3.client('s3',
                        endpoint_url=secret('aws_url'),
                        aws_access_key_id=secret('aws_access_key_id'),
                        aws_secret_access_key=secret('aws_access_key'),
                        region_name='us-east-1')

Currently, the use of secrets is implemented for code at Python. The use of secrets in code at SQL is under development. To use secrets in code at SQL, you can use the tngri.sql function.