Secrets at Shopify - Introducing EJSON - Shopify

What this post added

This post introduces EJSON, a library for encrypting secrets within JSON files using asymmetric encryption. It details the motivation for creating EJSON, including the limitations of previous methods like Chef's encrypted data bags. The post explains how EJSON works, including the encryption process and the use of public/private key pairs per project. It also outlines the key management strategy for Docker containers, focusing on securely provisioning decryption keys and decrypting secrets at runtime within the container's init process before the application starts. The post also touches on attaching metadata to secrets for improved auditing and rotation.