2025-03-20 Thu

• AWS

  • AWS/Event/ReInvent/25/Recap

• #Security

  • 1Password/Dev/How To/Replace .env secrets with op refs/Q/Can mise wrap op run
    • mise/GitHub/Issue/24/02/Struggles with integrating 1Password op
      • references mise/GitHub/Discussion/24/01/Vaults and Secrets Management
        • Tools discussed:
          • Secrets Manager
            • 1Password/Dev/op - 1Password CLI
            • sops - Mozilla's secret management tool
            • rops - Rust-based alternative for AWS/KMS
            • HashiCorp/Vault - Enterprise secret management
            • dotenv-org/vault - Encrypted .env files
            • keybase - Personal secret management
            • AWS/SSM/Param Store - AWS Systems Manager Parameter Store
          • Integration Tools:
            • direnv - Directory-based env management
            • Person/Vincent Prouillet/GitHub/tera - Template library used by mise
            • mise/plugin/mise-sops - sops plugin for mise
  • 1Password/Dev/How To/Replace .env secrets with op refs
    • 1Password/Blog/24/12/Replace .env with 1Password SDKs

      • • My Notes

          • how to migrate from EnvVar/.env files to 1Password's secure tooling
          • 1 - how to use 1Password/Dev/op/run and a 1Password Shared Vault to share secrets with other members on the dev team and inject them in to the EnvVar/.env file
          • 2 - how a remotely running automated script can use a 1Password Service Account and the 1Password/Dev/SDK/python to access secrets
          • comments - after this article, I have a better sense of how 1Password aims to cover the whole dev lifecycle.
            • I have an active #Question about the trade-offs of using this vs or with cloud-focused tools like HashiCorp/Vault or AWS/Secrets Manager. Duplication of secrets isn't fun, but convincing #DevOps to to use a tool that's convenient for development instead of HashiCorp Vault or an AWS-specific tool sounds even less fun. Maybe someone has made an integration ... ?
            • This article doesn't mention 1Password/Dev/Connect Server, which is the next level up from using a 1Password Service Account, and offers low latency and self-managed rate limits at the expense of self-hosting, etc. See 1Password/Dev/Doc/secrets-automation/Overview/Comparison
      • VSCode/Extension/1Password
        • • Select a secret in EnvVar/.env file and use VSCode/Extension/1Password/Command/Save in 1Password VSCode/Command to swap it for a secret reference
            • Before
              • bash

                # This is an example .env file that we will use to migrate  
                # from hosting the actual configurations of an environment  
                # over to a 1Password-managed environment. 
                
                # Environment Configuration  
                # options include  
                #         - development  
                #         - staging  
                #         - production  
                APP_ENV=development
                
                # Application Configuration  
                APP_NAME=OP SDJ ENV Demo Application
                
                APP_SECRET_TOKEN=QAZWSXEDCrfvtgbyhn 

            • highlight line 15, then use VSCode Save in 1Password
            • After, it's replaced with 1Password/Dev/CLI/Secret Reference
              • first, they move it to a generic vault named "Vault"
                • 
      • • Example Python remote script using 1Password Service Account
          • python

            import asyncio
            import os
            from onepassword import Client
            
            async def main():
              # You still need to load your Service Account Token from the OS, 
              # but let's do it without an additional package.  
              token = os.getenv("OP_SERVICE_ACCOUNT_TOKEN")
              client = await Client.authenticate(auth=token, 
                                               integration_name="DevRel Demo",
                                               integration_version="v0.0.1")
              
              app_name = await client.secrets.resolve("op://ENV_Demo_Secrets/Demo App Name/text")
              app_secret_token = await client.secrets.resolve("op://ENV_Demo_Secrets/Blog 1 ENV App_Secret_Token/Section_ty4kl2xveagt5wxcz4yzfzloia/token")

          • My Note If we've instrumented this so it can run as a remote job and use a 1Password Service Account, I think the assumption that locally, I'll then use 1Password/Dev/op op to get a 1Password/Dev/CLI/Secret Reference to load the OP_SERVICE_ACCOUNT_TOKEN ... is that right?
    • 1Password/Dev/Doc/sdks

      • • My Notes

          • requires a 1Password Service Account
    • 1Password/Dev/Connect Server
      • 1Password connect diagram

      • • Comparison table of when to use 1Password Service Account vs 1Password/Dev/Connect Server

          • Feature	Service accounts	Connect servers
            1Password CLI	✅	✅
            REST API	❌	✅
            Self-hosted	❌	✅
            Infrastructure requirements	❌	✅
            Low overhead	✅	❌
            Low latency	❌	✅
            Kubernetes integrations	✅	✅
            CI/CD integrations	✅	✅
            Rate limits	✅	❌
            Request quotas	✅	❌
            Included with 1Password subscription	✅	✅