WingNews logo WingNews GitHub [2]
top | item 7411927

Production AWS keys on GitHub

35 points| jxf | 12 years ago |github.com | reply

14 comments

order
[+] Lockyy|12 years ago|reply
I did a quick check and found a few people with their Rails App's secret token on display in config/initialisers/secret_token.rb. I guess most people reading this will already be aware but it's in the same vein as the AWS keys problem linked. Make sure this stuff hasn't been left in your public repos.
[+] oakwhiz|12 years ago|reply
I recommend putting your app's API keys into environment variables instead of configuration files for this reason.
[+] rrosen326|12 years ago|reply
Could you go through this process? I just did something where I used a file that was outside my repo but I knew there must be a best practice that I just didn't know about. What is it?
[+] sahat|12 years ago|reply
I was charged over $1696.00 in AWS Usage fees for putting my production AWS keys on GitHub. So think twice before you put any production keys out there, for the whole world to see. UPDATE: As spydertennis mentioned, I also had 15 Double XL EC2 instances running in multiple regions.
[+] MasterScrat|12 years ago|reply
Do you have any idea what they were doing? mining coins?!
[+] MasterScrat|12 years ago|reply
It would be interesting to have an application that Googles regularly this kind of sensitive information and tells you if it showed up somewhere public.

Of course it would need a full list of your sensitive keys and password, which it practice would be quite dangerous...

[+] MasterScrat|12 years ago|reply
What exactly happens when someone takes advantage of these keys?

Is it considered as "hacking", ie is the offender's Amazon account terminated? or is it "fair" in the sense that those credentials were willingly made public?

[+] spydertennis|12 years ago|reply
I got hacked a month ago because of this mistake. Someone initiated 15 heavy duty aws instances on my account. Luckily aws support noticed the huge increase in billing and called me to confirm. Now my github is private haha.
[+] testaccount4|12 years ago|reply
> Now my github is private

That is not the solution. You're supposed to isolate secrets from the code repository.

[+] catwf|12 years ago|reply
I did this once in a gist by mistake - meant to remove them before submitting it. Luckily someone spotted it and let me know so I could kill the access key.