Security Issue: AWS secrets keys revealed in migration files

[ashwanthbalakrishnan5]

settings.py :

STORAGES = {
    "default": {
        "BACKEND": "storages.backends.s3.S3Storage",
        "OPTIONS": {
            "access_key": env("AWS_ACCESS_KEY_ID"),
            "secret_key": env("AWS_SECRET_ACCESS_KEY"),
            "bucket_name": env("AWS_STORAGE_BUCKET_NAME"),
            "region_name": "ap-south-1",
            "file_overwrite": False,
        },
    },
    "PublicMediaStorage": {
        "BACKEND": "storages.backends.s3.S3Storage",
        "OPTIONS": {
            "access_key": env("AWS_ACCESS_KEY_ID"),
            "secret_key": env("AWS_SECRET_ACCESS_KEY"),
            "bucket_name": env("AWS_STORAGE_BUCKET_NAME"),
            "region_name": "ap-south-1",
            "default_acl": "public-read",
            "location": "media/public",
            "querystring_auth": False,
            "file_overwrite": False,
        },
    },
    "staticfiles": {
        "BACKEND": "storages.backends.s3.S3Storage",
        "OPTIONS": {
            "access_key": env("AWS_ACCESS_KEY_ID"),
            "secret_key": env("AWS_SECRET_ACCESS_KEY"),
            "bucket_name": env("AWS_STORAGE_STATIC_BUCKET_NAME"),
            "region_name": "ap-south-1",
            "default_acl": "public-read",
            "location": "staticfiles",
            "querystring_auth": False,
        },
    },
}

Models.py

from django.db import models
from django.core.files.storage import storages

class DemoModel(models.Model):
    file = models.FileField(
        upload_to="demo/",
        storage=storages["PublicMediaStorage"],
    )

Migration file:

Is this the correct way of passing the storage to FileField ?

[laurentdufloux]

Where are you running this code? If you run in EC2, the credentials will be periodically obtained from instance metadata and are available to boto3, you don't need to provide them. If you run in Lambda, likewise they will be in the environment. There is an issue with the latest version where the session token is not fetched and things will break but #1399 fixes it and the previous version was fine as well.

[maxmorlocke]

If you intend to use the standard variable names of AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY, the s3 storage backend will automatically look up and resolve these variables (https://django-storages.readthedocs.io/en/latest/backends/amazon-S3.html). So, you can remove those at least from the configuration and still get a working result, and this will ensure they are not kept in the migration file.

[ashwanthbalakrishnan5]

@laurentdufloux and @maxmorlocke thanks for the workaround.
But I feel this is still a security issue and needs fixing, So I'll keep the issue open.

Thanks Again !!!

[jschneier]

In general you should have separate configurations for your dev vs prod systems. Unfortunately this is how Django works with the migration system. Others have offered alternatives.