Ctrlk
For the complete documentation index, see llms.txt. This page is also available as Markdown.

Security and Secrets

Credential Types and Sources

Your deployment uses three types of credentials:

ECR Access Credentials

  • Source: Issued by Hivel to your named contact (unless using Option B, in which case you generate and control your own)

  • Scope: Hivel's ECR repository only (or your own if Option B)

  • Usage: Pulling container images during deployment

RDS Master Credentials

  • Source: Created when you provision the RDS instance (RDS Database Setup)

  • Storage option: If using AWS Secrets Manager, credentials live there instead of plaintext

  • Usage: One-time database migration only (Database Migration)

Application User Credentials

  • Source: Created automatically by flyway-migration (Database Migration)

  • Default password: Provided separately by Hivel

  • Usage: All services connect to the database using these credentials

Storing Credentials

Store all credentials in a secrets manager:

  • AWS Secrets Manager

  • Your organization's standard secrets tool

Do not:

  • Store credentials in plaintext files

  • Commit .env or other credential files to version control

Note on config/.env: This is a plaintext file by design for this deployment. Treat VM filesystem access as sensitive.

Least Privilege: Two-Phase Credential Pattern

This deployment implements least privilege for database access:

  1. Phase 1 (migration only): Root/master credentials used one time during database setup

  2. Phase 2 (services): All running services use scoped application-user credentials

See RDS Database Setup and Environment Configuration for details.

Rotating Credentials

Application User Password (Self-Rotatable)

You can rotate the application-user database password at any time without re-running migrations.

Step 1: Generate a strong password

Step 2: Update RDS

On the RDS instance, run:

Step 3: Update config/.env on the VM

Edit config/.env and replace the old password:

Refer to Environment Configuration for password-quoting rules.

Step 4: Restart services on the VM

Important: Existing database connections survive the password change but fail when they reconnect. Restart services immediately to avoid connection pool issues.

RDS Master Credentials

Do not rotate the RDS master credentials. They are used only during initial setup.

ECR Access Credentials

Hivel does not currently publish a rotation cadence. To rotate ECR credentials, contact your Hivel representative.

Back to Uninstall and Cleanup

Quick Reference

Last updated