Clarify synthetics params / secrets docs #3672
Closed
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
A documentation preview will be available soon: |
vigneshshanmugam
approved these changes
Mar 13, 2024
dedemorton
requested changes
Mar 19, 2024
There was a problem hiding this comment.
Just a few editorial changes.
BTW, it's much better if you submit your changes against the main branch (rather than a versioned branch) so that we can easily backport the changes. To do this, you just need to switch to master before you click the Edit link in the docs.
| @@ -2,10 +2,12 @@ | |||
| [[synthetics-params-secrets]] | |||
| = Work with params and secrets | |||
|
|
|||
| Params allow you to use dynamically defined values, including sensitive information, in your | |||
| Params allow you to use dynamically defined values, in your | |||
There was a problem hiding this comment.
Suggested change
| Params allow you to use dynamically defined values, in your | |
| Params allow you to use dynamically defined values in your |
| synthetic monitors. For example, you may want to test a production website with a particular | ||
| demo account whose password is only known to the team managing the synthetic monitors. | ||
|
|
||
| Please read the <<synthetics-secrets-sensitive, documentation on sensitive values>>for more information on security-sensitive use cases. |
There was a problem hiding this comment.
Suggested change
| Please read the <<synthetics-secrets-sensitive, documentation on sensitive values>>for more information on security-sensitive use cases. | |
| For more information about security-sensitive use cases, refer to the <<synthetics-secrets-sensitive, documentation about sensitive values>>. |
Comment on lines
+153
to
+156
| Please note that params are viewable in plain-text by administrators and other users with "all" privileges for | ||
| the synthetics app. | ||
| Additionally, note that synthetics scripts have no limitations on accessing these values, and a malicious script author could write a | ||
| synthetics journey that exfiltrates `params` and other data at runtime. |
There was a problem hiding this comment.
Suggested change
| Please note that params are viewable in plain-text by administrators and other users with "all" privileges for | |
| the synthetics app. | |
| Additionally, note that synthetics scripts have no limitations on accessing these values, and a malicious script author could write a | |
| synthetics journey that exfiltrates `params` and other data at runtime. | |
| Params are viewable in plain-text by administrators and other users with `all` privileges for | |
| the Synthetics app. | |
| Also note that synthetics scripts have no limitations on accessing these values, and a malicious script author could write a | |
| synthetics journey that exfiltrates `params` and other data at runtime. |
| Do *not* to use truly sensitive passwords (for example, an admin password or a real credit card) | ||
| in *any* synthetics tools. | ||
| Instead, set up limited demo accounts, or fake credit cards with limited functionality. | ||
| If you want to limit access to parameters ensure that that users who are not supposed to access those values do not have "all" privileges |
There was a problem hiding this comment.
Suggested change
| If you want to limit access to parameters ensure that that users who are not supposed to access those values do not have "all" privileges | |
| If you want to limit access to parameters, ensure that users who are not supposed to access those values do not have `all` privileges |
|
@dedemorton Thanks for the review, Andrew is out of office, I will open a new PR against the master branch to address your review comments and ask for final review. |
|
Closed in favor of #3691 |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Clarify and add detail to section on synthetics security / working with sensitive values