Keys and operations
Store and limit keys
Keep keys out of source and normal logs, use managed key services where appropriate, and grant only required encrypt, decrypt, sign, or verify operations.
8 minute lesson
A key’s storage and permissions are part of the cryptographic design. The strongest algorithm cannot protect an exposed key.
Prefer a KMS, HSM, secure enclave, or protected secret store that can restrict operations and record use. Separate keys by environment and purpose. Keep data and keys under different access paths when the architecture allows it.
A signing key is available as plaintext to the whole CI job, including formatting and test steps. A compromised test dependency can copy the same authority used for releases.
A managed key service can expose only a sign operation and keep raw key material inside the service. This narrows authority, but access policy and audit logs become part of the cryptographic system.
Build a key inventory with purpose, owner, environment, storage, allowed operations, users, rotation, and revocation. Save the effective policy and one audit event for an authorized test operation. Then attempt a forbidden operation, such as decrypting with a sign-only identity, and capture the denial.
Lesson completed