Expiring access keys #832

New issue

Open

opened 2024-06-05 03:21:50 +00:00 by jade · 2 comments

jade commented

2024-06-05 03:21:50 +00:00

It would be possible to just write a simple script that makes a key with name ephemeral-${date} and a timer to delete all such keys that are too old, but that is a workaround.

I would love to be able to create access keys that expire in like an hour. The reason I want to be able to do this is that long-lived secrets are a liability, and so I want to write a program that just logs into the garage server via ssh and makes a key on the spot, which then gets expired later. It would be possible to just write a simple script that makes a key with name `ephemeral-${date}` and a timer to delete all such keys that are too old, but that is a workaround.

flokli commented

2024-06-12 09:00:35 +00:00

Contributor

This looks related to #546 (comment).

This looks related to https://git.deuxfleurs.fr/Deuxfleurs/garage/issues/546#issuecomment-6207.

maximilien added the

kind

improvement

label 2024-07-25 19:23:41 +00:00

maximilien commented

2024-07-25 19:24:47 +00:00

Owner

I think our current stance is that we don't want to build specific logic like this withing garage. If you want to expire keys, you can easily write a script that pool garage every now and then and remove expired keys based on the admin API.