Add a credentials section to the fidesctl.toml config file that allows users to store credentials

[ThomasLaPiana]

Is your feature request related to a specific problem?

We need a way for users to be able to store credentials in their fidesctl.toml files or as env vars.

Describe the solution you'd like

We should use a key/value solution so that we can be flexible with our connection types, and also allow users to call that connection information via an id

Describe alternatives you've considered, if any

A description of any alternative solutions or features you've considered.

Additional context

Potential toml design:

[credentials.postgres]
postgres_conn_1 = "postgresql+psycopg2://postgres:fidesctl@fidesctl-db:5432/fidesctl_test"

[credentials.aws]
aws_creds_1 = {access_key_id=<something>, secret_access_key=<some_key>, default_region=<some_region>}

then the env vars would look like:

FIDESCTL__CREDENTIALS__POSTGRES_POSTGRES_CONN_1="<some creds>"
FIDESCTL__CREDENTIALS__AWS_AWS_CREDS_1_ACCESS_KEY_ID="<some id>"
FIDESCTL__CREDENTIALS__AWS_AWS_CREDS_1_SECRET_ACCESS_KEY="<some access key>"
FIDESCTL__CREDENTIALS__AWS_AWS_CREDS_1_DEFAULT_REGION="<some default region>"

[ThomasLaPiana]

related to #583

[SteveDMurphy]

Just for sake of discussion, would it be feasible to have a config.yml take an environment variable instead that the .toml points to? As far as I understood, .toml can't utilize an environment variable which would introduce some risk of a user storing these under version control

[ThomasLaPiana]

@SteveDMurphy while the toml can't directly load values from env vars, it's just one of the sources we populate our internal config from.

We prioritize env vars over the toml, but in the end they both get loaded into our internal python config. We give users the option of injecting either via env vars or putting them in the toml config.

[sanders41]

Would it make sense to put something in the documentation to remind people to add the toml file to the .gitignore if they are adding credentials to it? And maybe also steer the towards using environment variables in the docs also?

[ThomasLaPiana]

@sanders41 for sure, I think we should steer people towards using environment variables for sensitive credentials. I think gitignoring the whole config is usually a step too far though.

[sanders41]

Yes I agree. I was only thinking suggesting they gitignore it if sensitive info has been added.