Support subscription to credentials change
dafortune opened this issue · comments
I'd like to describe an use case I think might be interesting to support. We are currently using credstash on our services and one of the core features we need is supporting key rotation. What we do is:
- Getting the key from Credstash and putting it in a cache.
- We use that stored key to expose a public key that is used on services we interact with.
- When we rotate the key we need to clean the cache. So ALL OUR NODES get updated (and so get the new key + kid) at the same time.
To support #3 we'd were thinking that a pub-sub approach based on dynamo features might help, but not sure if you want this feature as part of the core (if so I could provide a PR). Opened this issues to know what you think.
Feels better as a separate module that uses credstash internally?