tree a5e84de88970cb3ea0ac5b2ca3a1ca8358c72481
parent fa74628bbd3e606386536383ac25f0c7d0ce52a5
author Jonathan Amsterdam <jba@google.com> 1681133099 -0400
committer Gopher Robot <gobot@golang.org> 1681158088 +0000

terraform: add HMAC secret key

Add a secret key to be used for computing HMACs of IP addresses
for vuln DB requests.

We use an HMAC (encrypted hash) rather than a hash alone to obfuscate
IP addresses so that no one can check a guessed IP against a hash
without knowing the secret.

Since no one ever needs to decode the result, the secret was generated
once, stored in Google Cloud Secret Manager, then discarded. It is
not stored anywhere else.

Change-Id: I9c24b2f2b8eff38ce9bbfdbcf903df665a494e88
Reviewed-on: https://go-review.googlesource.com/c/pkgsite-metrics/+/483037
Run-TryBot: Jonathan Amsterdam <jba@google.com>
TryBot-Result: Gopher Robot <gobot@golang.org>
Auto-Submit: Jonathan Amsterdam <jba@google.com>
Reviewed-by: Zvonimir Pavlinovic <zpavlinovic@google.com>