Secure secret management best practices for Adobe I/O Runtime Node.js applications
This article explains how to securely store and manage sensitive credentials in Adobe I/O Runtime Node.js applications that integrate with Adobe Experience Manager (AEM) and external services. Storing secrets in source code, configuration files, or logs increases the risk of credential exposure. To resolve the issue, store secrets securely and prevent credential exposure.
Description description
Environment
- Adobe Experience Manager (AEM) integrations
- Adobe I/O Runtime (Node.js)
- External service integrations
Issue/Symptoms
When developing serverless Node.js applications on Adobe I/O Runtime, sensitive credentials such as API keys, client secrets, access tokens, passwords, and private keys require secure storage and retrieval. The challenge is to prevent these credentials from being exposed in source code, configuration files, deployment artifacts, or application logs while ensuring that Runtime Actions can access them securely during execution.
Root cause
Secrets stored in source code, configuration files, or logs increase the risk of credential exposure. Adobe I/O Runtime provides mechanisms to manage secrets through default parameters securely. Organizations with advanced requirements should use dedicated secret-management solutions.
Resolution resolution
Follow the steps below to resolve the issue:
- Configure sensitive values, such as API keys, passwords, tokens, and private keys, as default parameters at the action or package level in Adobe I/O Runtime. These values are encrypted at rest and are decrypted only when the action executes. When retrieving configuration information, secret values appear as hashes and are not exposed in plain text.
- Do not store secrets in environment-specific configuration files or in the application source repository.
- Do not write secret values to application logs.
- For centralized governance, rotation, and auditing, use a trusted external secret-management solution to manage secrets outside Adobe I/O Runtime. Retrieve secrets securely during deployment or runtime.
- Review Adobe security guidance for additional details and best practices.