This session presents how Intuit's Data Protection team built and operates an internal platform for identity-based access to encryption keys and secrets across AWS, GCP, and third-party providers. The platform serves services and handles cryptographic operations at scale while keeping the developer experience simple.
The talk covers four components:
1. An identity broker that validates cloud workload identities and issues short-lived credentials. This eliminates secret sprawl and removes the need to rotate long-lived credentials.
2. A key management service built on a split-key architecture where the service itself never sees plaintext keys. Keys are encrypted client-side before reaching this service, so even a full database compromise would not expose key material. The system supports full key lifecycle management: creation, rotation, versioning, deactivation, and destruction; with state machine enforcement that prevents unsafe transitions. This design gives teams strong data protection guarantees without requiring them to understand cryptography.
3. An automation layer that creates time-limited access policies for cloud workloads on demand. When a new AWS IAM role or GCP service account needs access to encryption keys, the service provisions the policy automatically with an x-day expiration.
4. A browser-based developer UI integrated with Intuit's DevPortal, making secret management accessible with role-based access controls. Developers can manage secrets without needing SDKs or CLI tools, with different permission levels for admins, DevOps, developers, and data stewards. SDKs and CLIs are also available.
Key advantages of this approach: 1. Zero-knowledge key storage: the key management service never sees plaintext keys. Even an insider with database access cannot extract key material. 2. Least privilege by default: Access is provisioned as read-only and time-bounded automatically. Developers don't need to think about it. 3. Multi-cloud consistency: The same policy and access model works across providers, avoiding provider-specific tooling silos. 4. Developer experience: Security is embedded into the platform, not bolted on. Developers interact with a simple API or browser UI, not raw cryptographic primitives.
We'll discuss how these design patterns map to OWASP Top 10 categories and share practical lessons from operating this system at enterprise scale.
The session is aimed at security engineers and architects interested in practical approaches to multi-cloud secret and key management.
