Web应用敏感配置存储优选方案？云部署（AWS EBS/Heroku）数据库密码存储咨询

Great question—you’re totally right to steer clear of putting sensitive stuff like database passwords in .ebextensions (or any file that ends up in your version control system). Let’s break down the proper, secure approaches for both AWS Elastic Beanstalk and Heroku:

• Use AWS Secrets Manager or Systems Manager Parameter Store：These are AWS’s dedicated, secure services for storing sensitive data. Secrets Manager is perfect if you need automatic credential rotation (super useful for database passwords), while Parameter Store is a simpler fit for static secrets.
• Access secrets at deployment or runtime：You don’t need to hardcode secrets anywhere. Here’s how to set it up:
  • Use Platform Hooks (e.g., create a script in .platform/hooks/predeploy/) that fetches the secret from Secrets Manager/Parameter Store and sets it as an environment variable. Just ensure the .platform directory is included in your app bundle but never contains secrets itself.
  • Configure your EBS instance’s IAM role to have permission to access the specific secret/parameter your app needs. This follows the principle of least privilege—don’t grant broad access to all secrets.
  • Alternatively, your app can fetch the secret directly at runtime using the AWS SDK, but setting it as an environment variable is often easier for app compatibility.

• Use Config Vars：Heroku’s built-in Config Vars are made exactly for this use case. They’re stored securely in Heroku’s infrastructure and never show up in your version control.
  • Set them via the CLI with heroku config:set DATABASE_PASSWORD=your_secure_password
  • Or manage them through the Heroku Dashboard: go to your app’s "Settings" tab, then find the "Config Vars" section to add/modify variables.
• Heroku Postgres shortcut：If you’re using Heroku’s managed Postgres service, the full database URL (including the password) is automatically added as a Config Var named DATABASE_URL. You can use this directly in your app instead of setting a separate password variable.
• Accessing vars in your app：Your application can read these variables just like regular environment variables—for example, process.env.DATABASE_PASSWORD in Node.js, os.getenv("DATABASE_PASSWORD") in Python, or System.getenv("DATABASE_PASSWORD") in Java.

Whichever platform you pick, the golden rule stays the same: never commit sensitive credentials to version control. Using each platform’s native secret management tools keeps your data secure, eliminates the hassle of manual environment variable setup per instance, and makes it straightforward to rotate credentials later if needed.

内容的提问来源于stack exchange，提问作者m0etaz