Transcription
[Music] hi everyone in this video I'm going to show you how you can replace your hard-coded secrets in code and in environment variables with a one password Secrets reference and then use a one password service account to access that secret when you need it at runtime so I'm logged in to a remote machine here and I have a python script that will use the openai API to send a request and then print out that response received now the first step is to authenticate with the API by passing an API key if we look at the documentation for this openai python Library we'll see that they offer two suggestions on how to access that API key the first is a pretty standard way of setting an environment variable with that hard-coded secret as the value the second which is definitely not recommended is to hard code it in your code this is how it ends up in your repositories this is how it gets leaked this is not recommended so we will take the first Approach at least if we use an environment variable it won't end up in our repositories however there are other disadvantages to doing this that we'll discuss in a moment but first let's take this approach so we'll hop back over here and we will set this environment variable now I already have my API key stored in one password so I can access it through the quick access menu and just copy this credential and paste it there we go now let's double check that it's actually working by running our python script so I will ask it to write a haiku about whoops haiku about one password I don't know if that's actually Haiku but it still responded it authenticated and responded so there we go now what are the problems with using an environment variable so or a hard-coded value for an environment variable so as you just saw I just leaked my secret on this video so I have to go back to open AI roll that API key and get a new one and then I would have to go and update um every single environment variable that uses that value so that could be I mean that's a very definition of secret sprawl who knows where that might exist it's all over the place so how do we centralize that and make sure that there's a single source of Truth for that secret well as you saw I already have it stored in one password so what we can do instead of using the hard-coded value as the environment variable we can use a Secrets reference instead let me show you that so we already have the value here in one password I will view details and here I can copy the secrets reference I'll paste that in now it's a special string that starts with the op to tell it it's a it's a one password CLI command it provides the name of the Vault the name of the item itself and the value that we want so there we go I've set the um environment variable to use the secrets reference instead of the the raw value now if I were to run my python script again it would actually fail because I'm just passing that raw string and that's not the API key I need to reference the API key and inject it to do that I would need to use the op run command from the from the one password CLI which I have installed here version 2 2.18 however I am not logged in so if I run the um op user get me command you'll see that no accounts are configured now I have a few options I can I can't connect to the app directly because I'm on a remote machine and the app isn't installed but I could use the CLI to enter my username my password and my secret key however if I do that then this machine will now have access to all of my one password vaults and items so again that's not ideal for a remote environment I definitely don't want to do that I just want to give it access to this one Vault that has the items that I need for this script so what I will do is I'll authenticate using a one password service account so to do that I'll come back over to one password I'll come to the Integrations Tab and under infrastructure Secrets management I can select other create a service account and I'll give it the name open AI testing or test I can select which vaults it has access to I'm going to give it read-only access to the API Vault that has my credentials inside of it and then I'm given a token so let me copy that token and come back over here now it will export the op service account token environment variable and if I run the op user get dash dash me I will see that I am logged in now as openai test service account created 34 seconds ago wonderful so now to get this Secrets reference to actually inject the secret at runtime we'll use the op run command and pass the python command that we want to run which is openai test dot Pi there we go now we can say right a tagline for a romantic comedy about one password unlocking love one password at a time I love it great so that was a great example of how you can very quickly replace hard-coded secrets with Secrets references from one password and then use a service account to access those Secrets at runtime very quickly helping reduce secret sprawl helping improve your secrets management so thanks a lot for watching and be sure to head over to developer.onepassword.com to check out the rest of the great developer tools we're building to help developers improve their security and improve their workflows thanks again