Best practice approach for environment specific keys

Question

I'm using encrypt/key/real_aes and lockr to create environment specific encryption profiles. Ie, prod data should never be accessible on UAT, dev, local etc.

What I'm wondering about is whether I can easily swap out field encryption profiles on specific environments, or if I can change the key being used by the environment?

Ultimately, I'd just like keys to be available to their environment only. Lockr helps by never displaying the key, but I can still request the prod key from lockr when on local, etc.

I'm not sure I can do these while keeping my site secure so I'm hoping for some best practice solutions to this.

Thanks.

Answer 1

So, I reached out to one of the authors of key and the lockr service to get some help.

What I learned is, if using the key module without lockr, you can change the value of the key while keeping its machine name the same.

But, if using lockr (and you should be using lockr) it will create and swap keys for you based on your environment automatically. So, your encryption profile will automatically be kept up to date. Awesome stuff.

Hope this is helpful to others, the docs are here; https://docs.lockr.io/#separate-environments