シークレット管理、.env ファイルだけでは足りない理由 — 環境変数が漏れる経路とローテーション設計

ps -eo pid,user,comm | grep -E 'node|python'

   2841 app      node
   3102 app      python3

# 同じ UID または root ならプロセスの環境変数をまるごと読み取れる
tr '\0' '\n' < /proc/2841/environ | grep -iE 'key|token|secret|password'

DATABASE_URL=postgres://app:pr0d-Db-Pass@db.internal:5432/app
STRIPE_SECRET_KEY=sk_live_51NxbQ2Lk9vHc0pMz7RtYaWq
JWT_SIGNING_KEY=8f2a1c9d4e7b6a305f18c2d9e0b7a4f1

kubectl debug -it deploy/payments --image=busybox --target=app -- sh
# デバッグコンテナから
tr '\0' '\n' < /proc/1/environ

// 絶対に書いてはいけないコード
process.on('uncaughtException', (err) => {
  logger.error({ err, env: process.env }, 'fatal error, dumping context')
  process.exit(1)
})

# マスキングは完全に一致する文字列しか隠さない
set -x
curl -H "Authorization: Bearer $API_TOKEN" https://api.example.com/deploy
echo "$API_TOKEN" | base64        # base64 でエンコードするとマスキングを素通りする

+ curl -H 'Authorization: Bearer ***' https://api.example.com/deploy
+ base64
c2tfbGl2ZV81MU54YlEyTGs5dkhjMHBNejdSdFlhV3E=

docker build --build-arg NPM_TOKEN=npm_9f3aQ2v8Lx -t myapp:1.4.2 .
docker history --no-trunc myapp:1.4.2 | grep -o 'NPM_TOKEN=[A-Za-z0-9_]*'

NPM_TOKEN=npm_9f3aQ2v8Lx

# syntax=docker/dockerfile:1
FROM node:22-slim
RUN --mount=type=secret,id=npmrc,target=/root/.npmrc \
    npm ci --omit=dev

docker build --secret id=npmrc,src=$HOME/.npmrc -t myapp:1.4.2 .

# 新しい鍵を先に作ってデプロイしたうえで、旧鍵を無効化して削除する
aws iam create-access-key --user-name ci-deployer
aws iam update-access-key --access-key-id AKIAIOSFODNN7EXAMPLE \
  --status Inactive --user-name ci-deployer
aws iam delete-access-key --access-key-id AKIAIOSFODNN7EXAMPLE --user-name ci-deployer

aws cloudtrail lookup-events \
  --lookup-attributes AttributeKey=AccessKeyId,AttributeValue=AKIAIOSFODNN7EXAMPLE \
  --start-time 2026-07-01T00:00:00Z \
  --query 'Events[].[EventTime,EventName,Username,CloudTrailEvent]' --output text | head -20

git log --all --oneline -S 'AKIAIOSFODNN7EXAMPLE'

7c19ae4 chore: add deploy script
2f80b13 fix: correct region in deploy script

cat > replacements.txt <<'EOF'
AKIAIOSFODNN7EXAMPLE==>REDACTED
pr0d-Db-Pass==>REDACTED
EOF

git filter-repo --replace-text replacements.txt --force
git push --force-with-lease --all
git push --force-with-lease --tags

kubectl get secret app-db -o jsonpath='{.data.password}' | base64 -d; echo

pr0d-Db-Pass

ETCDCTL_API=3 etcdctl \
  --cacert=/etc/kubernetes/pki/etcd/ca.crt \
  --cert=/etc/kubernetes/pki/etcd/server.crt \
  --key=/etc/kubernetes/pki/etcd/server.key \
  get /registry/secrets/default/app-db | hexdump -C | head -4

00000000  2f 72 65 67 69 73 74 72  79 2f 73 65 63 72 65 74  |/registry/secret|
00000010  73 2f 64 65 66 61 75 6c  74 2f 61 70 70 2d 64 62  |s/default/app-db|
00000020  0a 6b 38 73 00 0a 0c 0a  02 76 31 12 06 53 65 63  |.k8s.....v1..Sec|
00000030  72 65 74 12 8e 01 0a 6f  0a 06 61 70 70 2d 64 62  |ret....o..app-db|

apiVersion: apiserver.config.k8s.io/v1
kind: EncryptionConfiguration
resources:
  - resources:
      - secrets
    providers:
      - kms:
          apiVersion: v2
          name: cloud-kms
          endpoint: unix:///var/run/kmsplugin/socket.sock
      - identity: {}

00000000  2f 72 65 67 69 73 74 72  79 2f 73 65 63 72 65 74  |/registry/secret|
00000020  0a 6b 38 73 3a 65 6e 63  3a 6b 6d 73 3a 76 32 3a  |.k8s:enc:kms:v2:|

kubectl get secrets --all-namespaces -o json | kubectl replace -f -

kubectl auth can-i get secrets --namespace payments --as dev@example.com

yes

apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: app-db
  namespace: payments
spec:
  refreshInterval: 15m
  secretStoreRef:
    name: aws-secretsmanager
    kind: ClusterSecretStore
  target:
    name: app-db
  data:
    - secretKey: password
      remoteRef:
        key: prod/payments/db
        property: password

permissions:
  id-token: write
  contents: read

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: arn:aws:iam::123456789012:role/gha-deploy
          aws-region: ap-northeast-2
      - run: aws sts get-caller-identity

{
    "UserId": "AROAY3EXAMPLEID:GitHubActions",
    "Account": "123456789012",
    "Arn": "arn:aws:sts::123456789012:assumed-role/gha-deploy/GitHubActions"
}

{
  "Condition": {
    "StringLike": {
      "token.actions.githubusercontent.com:sub": "repo:acme/*"
    }
  }
}

{
  "Condition": {
    "StringEquals": {
      "token.actions.githubusercontent.com:aud": "sts.amazonaws.com",
      "token.actions.githubusercontent.com:sub": "repo:acme/payments:environment:production"
    }
  }
}

spec:
  serviceAccountName: payments
  volumes:
    - name: aws-token
      projected:
        sources:
          - serviceAccountToken:
              audience: sts.amazonaws.com
              expirationSeconds: 3600
              path: token

vault read database/creds/payments-readonly

Key                Value
---                -----
lease_id           database/creds/payments-readonly/9tKq2xL0
lease_duration     1h
lease_renewable    true
password           A1a-3mQx9Zr7Kt2Vb0Ns
username           v-token-payments-readonly-8Xk1qP

import hmac, hashlib, os

SECRET = os.environ["WEBHOOK_SECRET"]

def verify(body: bytes, signature: str) -> bool:
    expected = hmac.new(SECRET.encode(), body, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, signature)

import hmac, hashlib, os

# カンマ区切りの有効な鍵のリスト。先頭が現在の署名鍵。
KEYS = [k.strip() for k in os.environ["WEBHOOK_SECRETS"].split(",") if k.strip()]

def sign(body: bytes) -> str:
    return hmac.new(KEYS[0].encode(), body, hashlib.sha256).hexdigest()

def verify(body: bytes, signature: str) -> bool:
    for key in KEYS:
        expected = hmac.new(key.encode(), body, hashlib.sha256).hexdigest()
        if hmac.compare_digest(expected, signature):
            return True
    return False

第1段階  新しい鍵を有効リストの末尾に追加してデプロイする → 旧鍵で署名、両方で検証
第2段階  新しい鍵をリストの先頭へ移してデプロイする       → 新鍵で署名、両方で検証
第3段階  旧鍵で署名されたリクエストが消えたか確認する     → 指標で確認
第4段階  旧鍵をリストから取り除いてデプロイする           → 新鍵だけが有効
第5段階  旧鍵を発行元で失効させる

def verify(body: bytes, signature: str) -> bool:
    for index, key in enumerate(KEYS):
        expected = hmac.new(key.encode(), body, hashlib.sha256).hexdigest()
        if hmac.compare_digest(expected, signature):
            metrics.increment("webhook.signature.verified", tags=[f"key_index:{index}"])
            return True
    metrics.increment("webhook.signature.failed")
    return False

# ワーキングツリーと履歴全体をスキャン
gitleaks detect --source . --redact --report-format json --report-path leaks.json

# コミット直前のステージされた変更だけを検査
gitleaks protect --staged --redact

Finding:     STRIPE_SECRET_KEY=sk_live_REDACTED
Secret:      REDACTED
RuleID:      stripe-access-token
File:        deploy/staging.env
Line:        14
Commit:      7c19ae4a2f3b18c0d95e7f4a6b2c1d80e3f9a5b6

repos:
  - repo: https://github.com/gitleaks/gitleaks
    rev: v8.18.4
    hooks:
      - id: gitleaks

trufflehog git file://. --only-verified --json | jq -r '.DetectorName + " " + .Verified'