python - Keep Secret Keys Out

Question

One of the causes of the local_settings.py anti-pattern is that putting SECRET_KEY, AWS keys, etc.. values into settings files has problem:

• Secrets often should be just that: secret! Keeping them in version control means that everyone with repository access has access to them.

My question is how to keep all keys as secret?

Answer 1

Store your local_settings.py data in a file encrypted with GPG - preferably as strictly key=value lines which you parse and assign to a dict (the other attractive approach would be to have it as executable python, but executable code in config files makes me shiver).

There's a python gpg module so that's not a problem. Get your keys from your keyring, and use the GPG keyring management tools so you don't have to keep typing in your keychain password. Make sure you are reading the data straight from the encrypted file, and not just creating a decrypted temporary file which you read in. That's a recipe for fail.

That's just an outline, you'll have to build it yourself.

This way the secret data remains solely in the process memory space, and not in a file or in environment variables.