Encrypting Sensitive Configuration Data in Spring Cloud Config

Encrypting sensitive configuration data in Spring Cloud Config is essential for securing information like passwords, API keys, and other credentials. This extra layer of protection is crucial because it helps prevent unauthorized access and ensures that sensitive data remains safe, even if the configuration files are exposed. By encrypting this data, you make your application more secure and protect it from attacks. In this article, we'll walk through how to encrypt sensitive configuration data in Spring Cloud Config.

What is Spring Cloud Config?

Spring Cloud Config is a tool in the Spring Framework that helps manage configuration settings for applications, especially in systems where many apps work together. Instead of having configuration files in each app, it stores these settings on a central server. This makes it easier to update and manage configurations across different environments like development, testing, and production, without needing to restart or redeploy the applications.

Key Features:

• Centralized Configuration: Instead of keeping configuration files in each application, Spring Cloud Config lets you manage them in one central place, like a Git repository or a file system. This simplifies configuration management across different environments.
• Integration with Spring Boot: Spring Cloud Config is closely integrated with Spring Boot, making it easy to use within Spring-based applications.
• Encryption and Decryption: Sensitive data like passwords, API keys, and credentials can be encrypted in the configuration files. Spring Cloud Config provides built-in support for decrypting this data at runtime, ensuring that sensitive information remains secure.

Steps to Encrypt Sensitive Configuration Data in Spring Cloud Config

Step 1: Set Up a Spring Boot Application as a Config Server

First, you need to set up a Spring Boot application that acts as a Config Server. This server will manage your configuration properties and provide them to client applications.

package com.example.configserver;

import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;
import org.springframework.cloud.config.server.EnableConfigServer;

@SpringBootApplication
@EnableConfigServer
public class ConfigServerApplication {
    public static void main(String[] args) {
        SpringApplication.run(ConfigServerApplication.class, args);
    }
}

Explanation:
This code defines a basic Spring Boot application that serves as a Config Server by enabling the @EnableConfigServer annotation. The main method starts the application.

Step 2: Configure the Config Server for Encryption

Next, configure the Config Server to use a Git repository for storing configuration files and set up encryption using a TextEncryptor.

package com.example.configserver;

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.core.env.Environment;
import org.springframework.cloud.config.server.config.ConfigServerProperties;
import org.springframework.cloud.config.server.environment.JGitEnvironmentRepository;
import org.springframework.cloud.config.server.environment.JGitEnvironmentRepositoryFactory;
import org.springframework.security.crypto.encrypt.Encryptors;
import org.springframework.cloud.config.server.support.TextEncryptorLocator;

@Configuration
public class ConfigServerConfig {

    @Bean
    public JGitEnvironmentRepository gitEnvironmentRepository(ConfigServerProperties configServerProperties, Environment environment) {
        return new JGitEnvironmentRepositoryFactory(configServerProperties).build(environment, "default");
    }

    @Bean
    public TextEncryptorLocator textEncryptorLocator() {
        return () -> Encryptors.text("your-symmetric-key-here", "your-salt-here");
    }
}

Explanation:
This configuration class sets up a JGitEnvironmentRepository to pull configurations from a Git repository. It also configures a TextEncryptorLocator to manage encryption and decryption using a symmetric key and salt.

Output:

Step 3: Encrypt Sensitive Data in Java

You can encrypt sensitive data directly in Java using the TextEncryptor class. This can be helpful if you need to manually encrypt values before storing them in your configuration files.

package com.example.configserver;

import org.springframework.security.crypto.encrypt.Encryptors;
import org.springframework.security.crypto.encrypt.TextEncryptor;

public class EncryptionUtility {

    public static void main(String[] args) {
        String secretKey = "your-symmetric-key-here";
        String salt = "your-salt-here";  // Use a random 8-byte hex string as salt

        TextEncryptor encryptor = Encryptors.text(secretKey, salt);

        String sensitiveData = "my-secret-password";
        String encryptedData = encryptor.encrypt(sensitiveData);

        System.out.println("Encrypted data: {cipher}" + encryptedData);
    }
}

Explanation:
This utility class demonstrates how to use TextEncryptor to manually encrypt a string of sensitive data. The encrypted data can then be stored in your configuration files.

Output:

Step 4: Set Up the Client Application

The client application needs to be set up to retrieve and decrypt the encrypted configuration from the Config Server.

package com.example.client;

import org.springframework.beans.factory.annotation.Value;
import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;
import org.springframework.cloud.bootstrap.config.PropertySourceLocator;
import org.springframework.cloud.config.client.ConfigServicePropertySourceLocator;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.core.env.Environment;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RestController;

@SpringBootApplication
@RestController
public class ClientApplication {

    @Value("${my.app.secret}")
    private String secret;

    public static void main(String[] args) {
        SpringApplication.run(ClientApplication.class, args);
    }

    @GetMapping("/secret")
    public String getSecret() {
        return "Decrypted secret: " + secret;
    }
}

@Configuration
class ClientConfig {

    @Bean
    public PropertySourceLocator configServicePropertySourceLocator(Environment environment) {
        ConfigServicePropertySourceLocator locator = new ConfigServicePropertySourceLocator();
        locator.setUri("http://localhost:8888");
        locator.setApplicationName("client-app");
        locator.setEnvironment(environment.getProperty("spring.profiles.active"));
        return locator;
    }
}

Explanation:
This code sets up a client application that retrieves configuration properties from the Config Server. The @Value annotation is used to inject the decrypted secret into the application, which can then be accessed through the /secret endpoint.

Output:

Step 5: Storing and Accessing Encrypted Data

Store the encrypted data in the remote configuration repository (e.g., Git):

The client application retrieves the encrypted value from the Config Server, where it is automatically decrypted using the configured TextEncryptorLocator.

Conclusion

Encrypting sensitive configuration data in Spring Cloud Config provides a secure way to manage and share confidential information across different services. By encrypting data on the server and automatically decrypting it on the client, you ensure that sensitive information like passwords and API keys remain protected throughout their use. This setup safeguards your application’s secrets by ensuring that sensitive configuration data is securely encrypted and handled.