Yeogieotae Secret Platform Build Story Part 1: Why We Built a Secret Repository

As the scale of services and projects grew, the need for systematic management of sensitive information such as DB passwords and API Keys emerged. With existing approaches, it was difficult to track access control and auditing — who accessed or changed what information and when — and the fragmentation of permission management also occurred as the organization expanded.

Also, to reduce the cognitive burden of developers having to directly recognize and manage sensitive information, the platform aimed for a structure that separates sensitive information from code and manages it centrally at the platform level.

The reasons for developing the in-house platform Secrethub instead of external solutions like AWS Secrets Manager or HashiCorp Vault are as follows.

• Resolving the complexity of account management: By naturally integrating with the existing internal account system, the burden of operating a separate authentication system was minimized.
• Supporting diverse environments: To be unaffected by EKS, EC2, local environments, and various Spring Boot versions, a pure Java-based Secrethub Loader library was designed.

With the introduction of Secrethub, the responsibility for managing sensitive information shifted from individual projects to the platform. Now, a Secret is no longer a value that developers must manage, but is defined as a resource that is safely injected when needed.