Skip to main content
  • EN

Hello,

I currently have some workbenches which access APIs and hence have secrets within them, which is fine when this is secured on FME Flow. 

I also want to set up version control, and have all of my workbenches uploaded to remote repo, GitHub.
 

TLDR: How can I secure my API secrets on GitHub?

So far I’ve looked into:

  • encrypting my workbenches 
  • Storing my API keys as published parameters on FME Flow
    • this may be hard to manage, especially when trying to run/debug/design any API workflows
    • if a user/developer accidentally hits ‘save parameters’, then this method will likely be redundant
    • can become messy and difficult to manage in general


Would setting up the secret as a password parameter within the workbench encrypt it in the .fmw? 

Will a password protected workbench still work on FME Flow?
 

 

What other options do I have?



Thanks.

What about making the published parameter = Private 

Unticking the Published

You also have the option “require Password Confirmation”.. but I’ve not seen this in use

 

You have a few options:

  • Password-protect the workspace: this encrypts the entire fmw, so secrets can’t be accessed by opening it in Workbench or a text editor. Note that the password is only required to open/edit the workspace, not to run it. So you’ll be able to use it on FME Flow.

  • Use an FME Web Connection: this is the recommended way to handle credentials. The connection details are stored securely on FME Flow and won’t be included in what you push to GitHub.

  • Externalize the secret: for example, store it in a local file (excluded from version control) or an environment variable, and make your workspace read it at runtime. This avoids publishing secrets but does require you to manage the security of that external storage yourself.

….

  • Externalize the secret: for example, store it in a local file (excluded from version control) or an environment variable, and make your workspace read it at runtime. This avoids publishing secrets but does require you to manage the security of that external storage yourself.

I’ve had lots of success doing this with things like Azure KeyVault and AWS KMS. the gist of it is:

  • Build a custom transformer that takes your key name and returns the secret
  • The Windows account being used is granted access to the key
  • The returned secret is then only used at run time
  • Keys can be rotated in the vault and no other updates are required

Community Stats

31,835
Posts
120,911
Replies
39,470
Members

Latest FME

Terms & ConditionsCookie settings
A product of
Safe Software respectfully acknowledges that we live, learn and work on the traditional and unceded territories of the Kwantlen, Katzie, and Semiahmoo First Nations.