#Keybase bots how to#
#Keybase bots update#
#Keybase bots manual#

We can of course use these files from anywhere by setting the appropriate environment variables. Now instead of distributing the AWS keys to Gitlab CI/CD variables we started to distribute them to AWS credentials files on Keybase teams. This is why it is so important for us to rotate all these keys often, and especially whenever someone leaves the team. Our personal user accounts to not have AWS keys, instead the AWS keys we use belong to functional/system/bot accounts that the people on our team share. For us the implementation that made most sense is the one that leverages Keybase teams to store shared AWS keys. What is so special about this filesystem tree is that the files and directories are not actually on the filesystems, instead each time we access them the Keybase client makes a call to the Keybase APIs to retrieve them. team: holds sub-directories per team the user is member of with private files that are available to the members of each team.private: holds files that the user wants to keep private.public: holds files that the user wants to make publicly available.Furthermore, Keybase provides a user-space mount point (usually at /keybase) that simulates a filesystem tree containing 3 main directories: This protects the key that is stored in a shared state file to ensure only its owner can actually use it (by using Keybase to decrypt it). We learned about Keybase while using Terraform because Terraform can use Keybase to encrypt AWS keys held in its state using a Keybase user handle. Everything is end-to-end encrypted based on asymmetric key cryptography. Keybase is a nice up and coming project, “A Slack but for the whole world.” as they say on their site. Now, what if our laptops (automatically) had access to the exact same AWS keys as the CI/CD pipelines do! In other words, what if we could distribute the same AWS keys to both the CI/CD pipeline and the developers? That way we would be absolutely sure they do not diverge.Įnter Keybase. Except, CI/CD variables have the latest and correct AWS keys while our laptops did not! Given the way we setup our CI/CD that shouldn’t be a problem since we can easily execute the same script that the jobs execute. However, sometimes CI/CD is not available and we need to run our automation pipelines manually (i.e. Once we had the AWS key distribution to CI/CD pipelines automated we stopped having broken builds due to incorrect or otherwise missing AWS keys. Third Base - Shared and secured access AWS keys Extracting all of these from the Terraform output, decrypting and then distributing them to Gitlab (from where Terraform deploys our infrastructure) and 1Password (where we store all our secrets for safekeeping) was super tedious. Making changes to Terraform to create new keys was the easy part.

24 spread out over the dev, tst, acc and prd environments.

However, there was one problem: We have to maintain a lot of AWS keys! Our fine-grain access control implementation means we use lots of AWS keys.

#Keybase bots manual#

This left us with making a few manual changes to Terraform code, running terraform a couple of times and finally the manual distribution of the keys.

Run Terraform to remove the old keys from AWS.

Remove the old keys from the Terraform configuration.

#Keybase bots update#

Update the keys and secrets in all the places you need them.

Run Terraform to create the keys in AWS.

Define new keys in your Terraform configuration.

Their procedure boils down to the following:

#Keybase bots how to#

We took a cue from and followed their implementation on how to rotate AWS keys using Terraform (which is our goto tool for interacting with APIs).

We have to manage access for several internal and external users (from multiple different organisations).

We automatically deploy a lot of infrastructure.

The entire project is in the public cloud.

'A stupid slack bot for printing fake very real money.When I started working on an ongoing big project, my first task was creating and documenting the on-boarding and off-boarding procedure. 'Cryptoboto is chat bot for Keybase that looks up cryptocurrency prices from CoinMarketCap for you.' They don't need it, and I can hook you up with a temporary throwaway number. 'Stop sharing your REAL phone number with companies that will sell your data or send you garbage. 'Keybase bot that posts weather information to a channel that has asked for it.'

'A bot! a chat bot! Which you can use as a certificate authority to sign ssh keys for usage on your servers!'Īdd bookmarks with tags using this Keybase bot. Submit a PR to get yours added below, and on Name An open source collection of all the bots available on Keybase.