Be careful when you type your secrets. You will not be able to read the value in the console once submitted.
How to secure a container
This page explains how to secure your container.
Before you start
To complete the actions presented below, you must have:
- A Scaleway account logged into the console
- Owner status or IAM permissions allowing you to perform actions in the intended Organization
- Created a containers namespace
- Deployed a container
- Created an authentication token for your container
Use secrets to store access keys and sensitive information
Instead of using environment variables (which are stored in clear text) for your containers, use secrets. These are pieces of information that can be used via environment variables, but are encrypted in storage.
Configure secrets from the Scaleway console
- Click Containers in the Serverless section of the side menu. The containers page displays.
- Click the relevant container namespace.
- Click the name of the container for which you want to define secrets.
- Click the Deployment tab.
- Scroll to the Secrets section of the page and click Add secret. Enter the key and value for your secret. Repeat for additional secrets.
Important
- Click Deploy container to submit your secrets and redeploy your container.
Configure secrets using the Serverless framework
Add secret
to your container’s description (more information in the plugin documentation).
We recommend using them with global environment variables or a .env
file stored independently (and kept secret).
secret:secret_1: ${env:SCW_SECRET_KEY}
We strongly suggest that you do not commit this in a Version Control System (VCS), and do not share your Project ID or access key. This helps to ensure the security of your configuration file, which may contain sensitive data.
Configure secrets using Terraform
Add the following resource description in Terraform:
secret_environment_variables = { "key" = "secret" }
Restrict access to your containers
You can set Serverless containers as private if you want, to protect them from unwanted or unauthorized calls.
Unauthenticated calls will be rejected, and your container will not be triggered. This feature is handy if an event triggers your container (CRON, and soon SQS or NATS trigger) or if you put them behind an API gateway or a proxy server (see examples in serverless-examples).
Restrict access from the Scaleway console
- Click Containers in the Serverless section of the side menu. The containers page displays.
- Click the relevant container namespace.
- Click the name of the container for which you want to define secrets.
- Click the Security tab.
- Set the Privacy Policy of the container to Private.
- If required, create an access token for your container.
Your container is now private, and requires an X-Auth-Token
header to be called:
curl -H "X-Auth-Token: <YOUR_CONTAINER_TOKEN>" <YOUR_CONTAINER_ENDPOINT>
Restrict access using the Serverless framework
Set privacy: private
in your container’s description.
Your container is now private, and requires an X-Auth-Token
header to be called:
curl -H "X-Auth-Token: <YOUR_CONTAINER_TOKEN>" <YOUR_CONTAINER_ENDPOINT>
Refer to the How to create an authentication token documentation for more information.
Restrict access using Terraform
Set privacy = "private"
in your Terraform resource description.
You can generate access credentials to inject in other applications, such as containers and functions, directly from Terraform using the container_token resource.
Set up alerts in Observability Cockpit (upcoming feature)
Using Scaleway Observability Cockpit, a managed Grafana solution to which all your containers are connected, you can:
- Monitor your containers using the default dashboard or create custom ones.
- Set up notifications to be alerted in case of unexpected behavior.