TechPrufer
Get started
Shopify
Shopify logoShopify · Feature trail

GCP Project-Wide SSH Key Management

1 post · Jan 2021

What this trail covers

Shopify has evolved its approach to managing SSH keys within Google Cloud Platform project-wide metadata. Initial efforts focused on addressing the security risks associated with persistent, unmanaged SSH keys, which could lead to unauthorized access and security vulnerabilities. The development of SSH-Pruner aims to automate the management of these keys, ensuring they do not persist longer than necessary and distinguishing between Shopify's keys and Google's infrastructure keys. The tool iterates through projects, identifies SSH keys in project metadata, and removes those without valid expiration dates, while preserving unexpired keys and Google's infrastructure keys. This ensures keys do not persist longer than necessary and minimizes impact on developer workflows.

All Shopify trails
  1. Managing Google Cloud Platform Project-Wide SSH Keys - ShopifyThis post details the development of SSH-Pruner, a new application written in Go, to manage SSH keys in GCP project-wide metadata. The application iterates through projects, identifies SSH keys, and removes those without valid expiration dates. It preserves unexpired keys and distinguishes between Shopify's keys and Google's infrastructure keys. The post also discusses the challenges of previous approaches, such as deleting Google's keys and the slow operation of re-adding keys, and outlines the criteria for a successful solution: ensuring keys do not persist longer than necessary, minimal impact on developer workflows, distinguishing between Shopify and Google keys, and creating useful logging.