1

I'm currently using the azure-cosmos module in Python to connect to a database on Azure. I want to fetch the data, make a few transformations, and then push it to a new container.

You need the key and client ID to connect to the database, which I've used as variables in my code for now, as follows:

url = 'https://xyz.azure.com:443/'
key ='randomlettersandnumbers=='
client = CosmosClient(url, credential=key)

This seems to be a bad practice intuitively, and especially once I push this to Git, anyone could gain access to my database. So what's the most secure way to do this?

I'm coming from a non-SWE background, so apologies if this question is dumb.

Thanks!

user3424575
  • 101
  • 5
  • Extract sensitive data to a config file (there is for example `configparser` module for this), add this config to .gitignore and load it during runtime. – matszwecja Apr 13 '22 at 09:29
  • a neat module for storing settings (or environment variables) is https://pypi.org/project/python-dotenv/ – FabianClemenz Apr 13 '22 at 09:34

1 Answers1

3

The way I deal with this kind of problem is by using environment variables

import os

url = os.environ.get("url-endpoint")
key = os.environ.get("api-key")
client = CosmosClient(url, credential=key)

You can set them in your ssh shell like that:

export url-endpoint="https://xyz.azure.com:443/"
export api-key="randomlettersandnumbers=="

Or you can put them in a bash script envs.sh

export url-endpoint="https://xyz.azure.com:443/"
export api-key="randomlettersandnumbers=="

And then you can use source command.

source envs.sh

You have a good article about storing sensitive data using environment variables here

PleSo
  • 314
  • 1
  • 11
  • 2
    And to add to this answer, on the Azure side of things, you'd just set the key in the environment variables of the VM's/instances. Btw, since the code can't proceed without these values, there's no need to do `key = os.environ.get("api-key")` only to let it fail o n the client-connect step. Let it fail immediately on `key = os.environ["api-key"]` if the env var is not set. `.get()` defaults to None which is not helpful unless using a 2nd-level default in code. – aneroid Apr 13 '22 at 09:48
  • 1
    You are right. Good point. Usually i have 2nd level default in my code using arguments for user/password. Or i raise an exception with some information if nothing is provided so usually i find .get() method more elegant – PleSo Apr 13 '22 at 10:19
  • Yes, except that having those 2nd level defaults in code means it's in Git or wherever else the code is stored at rest. Leading to the same security problem the OP referred to. If it's a case that the **default won't work on production**, and is only for localhost or dev, then yeah, that kind of 2nd level default is okay to keep in code. – aneroid Apr 13 '22 at 13:46