Cross-Organization Secret Sharing for Collaborative AI Projects

Question

Pulumi · Accepted Answer

When working on collaborative AI projects across different organizations, there is often a need to share secrets, such as API keys or database connections, in a secure manner. As an infrastructure as code tool, Pulumi enables you to orchestrate such sharing while maintaining security and compliance.

In this context, one can leverage various cloud services to manage and share secrets. AWS Secrets Manager, Azure Key Vault, and Google Cloud Secret Manager are a few examples of cloud services that provide a way to safely store, manage, and access secrets.

In the scenario where you want to share secrets across organizations for collaborative AI projects, you would typically:

1. Store secrets securely in your cloud provider's secret management service.
2. Control access to the secrets using the cloud provider's identity and access management system.
3. Share the secrets with the authorized identities belonging to the other organizations.

Below is a Pulumi Python program that demonstrates how to securely share a secret in AWS Secrets Manager between two AWS accounts. The example assumes you have proper permissions set up in AWS IAM that allow Account A to write a secret and Account B to read that secret.

```python
import pulumi
import pulumi_aws as aws

# Create a new secret in AWS Secrets Manager for Account A.
# This could be an API key or sensitive connection details.
secret = aws.secretsmanager.Secret("ai-project-secret",
                                   description="Secret for AI collaborative project")

# Secret value to be stored and shared
# This is a raw string, however in a real-world scenario you might fetch this from configuration,
# environment variable, or generate dynamically
secret_value = aws.secretsmanager.SecretVersion("ai-project-secret-value",
                                                secret_id=secret.id,
                                                secret_string="YOUR_SECRET_VALUE")

# Define a resource-based policy that grants permissions to another AWS account (Account B)
# to access the secret created by Account A.
resource_policy = {
    "Version": "2012-10-17",
    "Statement": [{
        "Effect": "Allow",
        "Principal": {"AWS": "arn:aws:iam::ACCOUNT_B_ID:root"},
        "Action": ["secretsmanager:GetSecretValue"],
        "Resource": "*"
    }]
}

# Attach the resource policy to the secret.
secret_policy = aws.secretsmanager.SecretPolicy("ai-project-secret-policy",
                                                secret_id=secret.id,
                                                policy=pulumi.Output.from_input(resource_policy).apply(pulumi.json.encode))

# Export the secret ARN so that it can be referenced by Account B.
# Account B will need this ARN to configure their own applications and infrastructure to access the secret.
pulumi.export("ai_project_secret_arn", secret.arn)
```

In this program:

- A new secret is created in AWS Secrets Manager (`aws.secretsmanager.Secret`).
- The secret value is attached to the secret with a `SecretVersion` resource.
- A resource policy is defined that allows another AWS account (Account B) to access the secret. The policy is attached using the `SecretPolicy` resource.
- We export the ARN of the secret so Account B can reference it to access the secret.

Remember that both organizations need the appropriate permissions and trust relationships configured within their AWS IAM to make cross-account secret access work.

This program acts as an essential part of the solution for sharing secrets; complementary steps include setting up IAM roles, policies, and trust relationships on both sides to ensure secure and governed access to the shared secrets.

Please replace `'YOUR_SECRET_VALUE'` with the actual secret value to be stored, and `ACCOUNT_B_ID` with the AWS ID of the account that should have access to the secret. Make sure to scope down the Resource and Actions as per your organizational policies for finer-grained access control.