Hardcoded Confluent credentials in source codeSCT-1043

Using hardcoded Confluent credentials in source code can pose a security risk as it can give unauthorized access to Confluent resources such as Kafka clusters, schema registries, and ksqlDB. This can result in a data breach and financial loss due to unauthorized utilization of Confluent resources.

If the credentials have been leaked, it is recommended to rotate your credentials to mitigate the vulnerability.

To avoid this issue, it is recommended to use environment variables to store the Confluent credentials. This ensures that the credentials are not hardcoded in the source code and are kept separate from the codebase. Using environment variables also makes it easier to manage the credentials as they can be updated without modifying the source code. Additionally, it is recommended that access to the credentials is restricted to only those who need it, by using Confluent access control lists (ACLs).

Bad practice

from confluent_kafka import Producer

conf = {
    'bootstrap.servers': 'localhost',
    'sasl.username': 'my_username',
    'sasl.password': 'my_password',
    'security.protocol': 'SASL_SSL',
    'sasl.mechanism': 'PLAIN',
}

p = Producer(conf)

p.produce('my_topic', key='key', value='value')

Recommended

from confluent_kafka import Producer
import os

conf = {
    'bootstrap.servers': 'localhost',
    'sasl.username': os.getenv('CONFLUENT_USERNAME'),
    'sasl.password': os.getenv('CONFLUENT_PASSWORD'),
    'security.protocol': 'SASL_SSL',
    'sasl.mechanism': 'PLAIN',
}

p = Producer(conf)

p.produce('my_topic', key='key', value='value')