TechPrufer
Sign inGet started

Blogs›Shopify›GCP Project-Wide SSH Key Management

GCP Project-Wide SSH Key Management

GCP Project-Wide SSH Key Management

1
posts
2021

This feature thread tracks the development and enhancement of Shopify's approach to managing SSH keys within Google Cloud Platform project-wide metadata. Initial efforts focused on addressing the security risks associated with persistent, unmanaged SSH keys, which could lead to unauthorized access and security vulnerabilities. The development of SSH-Pruner aims to automate the management of these keys, ensuring they do not persist longer than necessary and distinguishing between Shopify's keys and Google's infrastructure keys. The solution involves iterating through projects, identifying compute-enabled projects, and pruning SSH keys that lack valid expiration dates, while preserving essential Google infrastructure keys and unexpired Shopify keys. This initiative aims to enhance security posture without negatively impacting developer workflows.

2021

Managing Google Cloud Platform Project-Wide SSH Keys - Shopify

1/27/2021

This post details the development of SSH-Pruner, a Go application designed to manage project-wide SSH keys in Google Cloud Platform. It addresses the security risks of persistent SSH keys by implementing a 'just-in-time access' model. The solution iterates through GCP projects, identifies compute-enabled ones, and prunes SSH keys from project metadata that lack valid expiration dates. It distinguishes between Shopify's keys and Google's infrastructure keys, ensuring the latter are preserved. The application parses metadata line by line, adds only unexpired keys to a new metadata object, and overwrites the project metadata. Robust testing and a focus on Go best practices were emphasized during development.