Building Uber’s Multi-Cloud Secrets Management Platform to Enhance Security

This post details the evolution of Uber's secrets management capabilities, focusing on the development of a centralized Secret Management Platform. Key contributions include the implementation of preventive measures (CLI pre-commit hooks) and remediation strategies (real-time and scheduled scanning of code, Slack, logs, container images) to combat secrets sprawl. It describes the consolidation of 25 disparate secret vaults into 6 managed vaults, reducing secrets distributed to data pipeline containers by up to 90%. The platform's core components are outlined: a metadata model (secret provider, deployment platform, secret impact level), user interfaces (API, CLI, web UI), secret lifecycle management workflows (rotation, deletion, revocation), access management, third-party integrations, and a governance dashboard. The post also elaborates on enabling automated secret rotation and deletion by integrating with various deployment platforms (Up, Kubernetes, Odin, Athena, YARN, Piper, DSW) and handling diverse secret types, including those requiring atomic pair rotation.