CODEWITHSUNDEEP
google-cloud-platformgoogle-cloud-functions
gdollardollar
gdollardollar

Reputation: 545

Best way to store and share cryptographic keys on GCP accross functions

Some functions I am writing would need to store and share a set of cryptographic keys (<1kb) somewhere so that:

The keys are modified (and written) every 4 hours or so, based on whether a key has expired or a new key needs to be created.

Right now, I am storing the keys as encrypted binary in a cloud bucket with access limited to that function. It works, except that it is fairly slow (~500ms for the read / write that is required when updating the keys).

I have considered some other solutions:

The library I use in my functions is available here.

Is there a better way to store a single small blob of data for cloud functions (and possibly other tools like GKE) ?

Edit

The solution I ended up using was using a single table in a database that the app was already connected to. It is also about 5 times faster than using a bucket (<100ms).

The moral of the story is to use whatever is already provisioned to store the keys. If storing a key is a problem, then using the combo KMS + cloud functions for rotations described below seems like a good option.

All the code + more details are available here.

Upvotes: 1

Views: 178

Answers (1)

Chris32
Chris32

Reputation: 4961

A better approach would be to manage your keys with Cloud KMS. However, as you mentioned before Cloud KMS does not automatically delete the old key version material and you will need to manually delete old versions which I suspect is a thing that you don’t want to do.

Another possibility is to just keep the keys in Firestore. Since for this you don’t have to provision any specific infrastructure such as with Redis Memorystore and Postgres Cloud SQL it will be easier to manage and to scale in the long run.

The general idea would be to have a Cloud Function triggered by Cloud Scheduler every 4 hours, and this function will rotate the keys on your Cloud Firestore.

How does this sound to you?

Upvotes: 1

Related Questions