Skip to content

Commit c24040d

Browse files
Update content/en/docs/_index.md
Co-authored-by: Felix Fontein <felix@fontein.de> Signed-off-by: fhoekstra <32362869+fhoekstra@users.noreply.github.com>
1 parent 33533f5 commit c24040d

1 file changed

Lines changed: 1 addition & 1 deletion

File tree

content/en/docs/_index.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1873,7 +1873,7 @@ Commit and push the updated file.
18731873
18741874
This ensures that *first* the compromised key is removed from the list of keys that has access to the per-file data key, and only *then* rotates the data key. If done in the wrong order, the compromised key could still have access to the data in some cases[^1].
18751875
1876-
[^1]: While it is generally better to schedule the operations this way, doing it the other way is only a problem in two specific situations: secret.sops.yaml file is checked in between the two sops calls above; alternatively, the compromised key is with a cloud provider (AWS, Azure, GCP, HWC, Vault) which is compromised itself, so that the call to encrypt the document key actually stores that document key.
1876+
[^1]: While it is generally better to schedule the operations this way, doing it the other way is only a problem in two specific situations: the `secret.sops.yaml` file is checked in between the two sops calls above; alternatively, the compromised key is with a cloud provider (AWS, Azure, GCP, HWC, Vault) which is compromised itself, so that the call to encrypt the document key actually stores that document key.
18771877
18781878
Running `sops rotate` periodically is recommended anyways.
18791879

0 commit comments

Comments
 (0)