| name | cloud-secrets-encryption |
| description | Guide complet de gestion des secrets et chiffrement multi-cloud — KMS, Secrets Manager, Key Vault, HSM, chiffrement au repos/transit, PKI, rotation automatique, durcissement crypto |
| category | cybersecurite |
Cloud Secrets & Encryption — AWS / GCP / Azure
1. AWS — Gestion des Secrets & Chiffrement
AWS KMS (Key Management Service)
aws kms create-key --description "Production Master Key" --origin AWS_KMS
aws kms create-key --description "Signing Key" --key-usage SIGN_VERIFY --customer-master-key-spec RSA_2048
aws kms create-alias --alias-name alias/prod-key --target-key-id <key-id>
aws kms enable-key-rotation --key-id <key-id>
aws kms get-key-policy --key-id <key-id> --policy-name default
aws kms put-key-policy --key-id <key-id> --policy-name default --policy file://key-policy.json
aws kms encrypt --key-id alias/prod-key --plaintext fileb://secret.txt --output text --query CiphertextBlob | base64 --decode > secret.encrypted
aws kms decrypt --ciphertext-blob fileb://secret.encrypted --output text --query Plaintext | base64 --decode
aws kms generate-random --number-of-bytes 32
AWS Secrets Manager
aws secretsmanager create-secret --name prod/db/password --secret-string '{"username":"admin","password":"P@ssw0rd"}'
aws secretsmanager rotate-secret --secret-id prod/db/password
aws secretsmanager get-secret-value --secret-id prod/db/password
aws secretsmanager get-secret-value --secret-id prod/db/password --query SecretString --output text | jq .
aws secretsmanager list-secrets
aws secretsmanager list-secret-version-ids --secret-id prod/db/password
aws secretsmanager get-resource-policy --secret-id prod/db/password
AWS Systems Manager Parameter Store
aws ssm put-parameter --name /prod/app/db-url --value "postgresql://prod.internal:5432" --type SecureString --key-id alias/prod-key
aws ssm get-parameter --name /prod/app/db-url --with-decryption
aws ssm get-parameters-by-path --path /prod/ --recursive
AWS CloudHSM
aws cloudhsmv2 create-cluster --hsm-type hsm1.medium
aws cloudhsmv2 initialize-cluster --cluster-id <id> --signed-cert file://customerCert.pem
AWS Certificate Manager (ACM)
aws acm request-certificate --domain-name app.domain.com --validation-method DNS
aws acm import-certificate --certificate file://cert.pem --private-key file://key.pem --certificate-chain file://chain.pem
aws acm-pca create-certificate-authority --certificate-authority-configuration file://ca-config.json
2. GCP — Gestion des Secrets & Chiffrement
Cloud KMS
gcloud kms keyrings create prod --location global
gcloud kms keys create prod-key --keyring prod --location global --purpose encryption
gcloud kms keys update prod-key --keyring prod --location global --rotation-period 30d --next-rotation-time "2026-01-01T00:00:00Z"
echo -n "secret-data" | gcloud kms encrypt --key prod-key --keyring prod --location global --plaintext-file - --ciphertext-file - | base64
gcloud kms decrypt --key prod-key --keyring prod --location global --ciphertext-file - --plaintext-file - | base64 --decode
gcloud kms keys create signing-key --keyring prod --location global --purpose asymmetric-signing --default-algorithm rsa-sign-pkcs1-2048-sha256
gcloud kms keys add-iam-policy-binding prod-key --keyring prod --location global --member user:admin@domain.com --role roles/cloudkms.cryptoKeyEncrypterDecrypter
Secret Manager
echo -n "supersecret" | gcloud secrets create db-password --data-file=-
gcloud secrets versions list db-password
gcloud secrets versions access latest --secret=db-password
gcloud secrets versions add db-password --data-file=new-secret.txt
gcloud secrets add-iam-policy-binding db-password --member user:admin@domain.com --role roles/secretmanager.secretAccessor
gcloud secrets update db-password --rotation-period 30d --next-rotation-time "2026-01-01T00:00:00Z" --next-rotation-topic projects/<project>/topics/rotate
Cloud HSM
gcloud kms keys create hsm-prod-key --keyring prod --location global --purpose encryption --protection-level hsm
Certificate Authority Service
gcloud privateca pools create prod-pool --location us-central1
gcloud privateca roots create prod-ca --pool prod-pool --location us-central1 --subject "CN=CA Root,O=MyOrg"
gcloud privateca certificates create app-cert \
--pool prod-pool --location us-central1 \
--csr file://app.csr \
--validity "P365D"
3. Azure — Gestion des Secrets & Chiffrement
Key Vault
az keyvault create --name <vault> --resource-group <RG> --sku Premium --enable-rbac-authorization true --enable-soft-delete true --enable-purge-protection true
az keyvault secret set --vault-name <vault> --name "db-password" --value "P@ssw0rd"
az keyvault secret show --vault-name <vault> --name "db-password"
az keyvault secret list --vault-name <vault>
az keyvault secret recover --vault-name <vault> --name "db-password"
az keyvault secret purge --vault-name <vault> --name "db-password"
az keyvault key create --vault-name <vault> --name "rsa-key" --protection hsm --kty RSA-HSM --size 4096
az keyvault key encrypt --vault-name <vault> --name "rsa-key" --algorithm RSA-OAEP --value <plaintext>
az keyvault key decrypt --vault-name <vault> --name "rsa-key" --algorithm RSA-OAEP --value <ciphertext>
Azure Disk Encryption
az vm encryption enable --resource-group <RG> --name <vm> --disk-encryption-keyvault <vault> --key-encryption-key <key>
az storage account update --name <account> --resource-group <RG> --encryption-key-name <key> --encryption-key-source Microsoft.Keyvault
App Configuration / Managed Identity
az appconfig kv set --name <config-store> --key "db:password" --value "P@ssw0rd" --label prod
az appconfig kv set --name <config-store> --key "db:password" --value "dev_pass" --label dev
4. Attaques sur les Secrets Cloud
Extraction depuis Variables d'Environnement
aws lambda get-function-configuration --function-name <name> --query Environment
gcloud functions describe <name> --format="get(environmentVariables)"
az functionapp config appsettings list --name <app> --resource-group <RG>
Side-Channel via Logs
aws logs filter-log-events --log-group-name /aws/lambda/<func> --filter-pattern "password"
aws logs filter-log-events --log-group-name /aws/lambda/<func> --filter-pattern "secret"
aws cloudtrail lookup-events --lookup-attributes AttributeKey=ResourceName,AttributeValue=<bucket> --query "Events[].CloudTrailEvent"
gcloud logging read "resource.type=cloud_function AND textPayload=password"
Key Vault Misconfigurations
az keyvault show --name <vault> --query properties.networkAcls
aws kms get-key-policy --key-id <key> --policy-name default | jq '.Statement[] | select(.Effect == "Allow" and .Principal == "*")'
gcloud kms keys get-iam-policy prod-key --keyring prod --location global
Secrets dans Git / CI/CD
gitleaks detect --source . --verbose
trufflehog filesystem --directory .
curl -H "Authorization: token <gh-token>" https://api.github.com/repos/org/repo/secret-scanning/alerts
5. Bonnes Pratiques
Rotation Automatique
aws secretsmanager rotate-secret --secret-id <id> --rotation-rules "AutomaticallyAfterDays=30"
gcloud secrets update db-password --rotation-period 2592000s
Least Privilege sur les Clés
"Condition": {
"StringEquals": {
"kms:ViaService": "s3.amazonaws.com"
}
}
"condition": {
"expression": "resource.name.startsWith('projects/_/locations/global/keyRings/prod')"
}
Détection des Anomalies
aws guardduty list-findings --detector-id <id>
gcloud scc findings list --organization <org> --filter "state=\"ACTIVE\" AND category=\"cryptomining\""
az security alert list --filter "alertDisplayName eq 'CryptoMining'"
BYOK / HYOK (Bring Your Own Key)
az keyvault key import --vault-name <vault> --name byok-key --byo-file key.pem
6. Outils
| Outil | Description |
|---|
| gitleaks | Secret scanning dans git |
| truffleHog | Deep secret scanning |
| detect-secrets | Yelp secret detection |
| kms-security-audit | Audit KMS politique |
| keyvault-bench | Benchmark Azure KV |
| vault-operator | HashiCorp Vault |
| aws-nuke | Nettoyage de comptes |
Ressources
