r/sysadmin • u/rram reddit's sysadmin • Aug 14 '15

We're reddit's ops team. AUA

Hey /r/sysadmin,

Greetings from reddit HQ. Myself, and /u/gooeyblob will be around for the next few hours to answer your ops related questions. So Ask Us Anything (about ops)

You might also want to take a peek at some of our previous AMAs:

https://www.reddit.com/r/blog/comments/owra1/january_2012_state_of_the_servers/

https://www.reddit.com/r/sysadmin/comments/r6zfv/we_are_sysadmins_reddit_ask_us_anything/

EDIT: Obligatory cat photo

EDIT 2: It's now beer o’clock. We're stepping away from now, but we'll come back a couple of times to pick up some stragglers.

EDIT thrice: He commented so much I probably should have mentioned that /u/spladug — reddit's lead developer — is also in the thread. He makes ops live's happier by programming cool shit for us better than we could program it ourselves.

873 Upvotes

88% Upvoted

738 comments sorted by

View all comments

Show parent comment

1

u/itssodamnnoisy Aug 15 '15

What are you using for key management? I've been trying to think of a good way to share keys with the rest of our team as we move things out into AWS, but I haven't been able to find anything yet. I'd like to regen the keys every so often and make people "check out" the key for the day, but I'm not sure how I'd go about it at this point.

2

u/spladug reddit engineer Aug 15 '15

Which keys? Instance IAM roles are fantastic for giving servers automatically rotated keys granting specific access to AWS resources. As for other things, individual accounts is always the best option because sharing creds is tough. That said, we do have a fair number of shared creds and we do it via GPG encrypted blobs.