1

In continuing to evaluate the best approach to storing security credentials, I have found the following Trailhead module for Secure Secret Storage: https://trailhead.salesforce.com/content/learn/modules/secure-secret-storage?trail_id=security_developer

In my use case, custom metadata types are the best fit as I would like to store multiple environment endpoints for the same service with a public custom setting to control which endpoint it points to (UAT, SIT, PROD). However I have a concern regarding how quickly the secret is updated.

Consider a situation where there is a breach in security for a service provider that SF connects to and the secret credentials need to be updated. Salesforce documentation states: "updated secrets in metadata types aren’t available right away".

What does "right away" mean? Is it scheduled to whenever the org has availability to process the metadata change similar to a future method or is there a standard propagation time for changes to salesforce metadata? Maybe something similar to a changeset deployment?

Improve this question
3
  • 2
    Are you building a managed package? You can only use protected custom metadata types in a managed package.
    – David Reed
    Commented Jun 19, 2020 at 15:55
  • I thought I could create a managed package even though we are not an ISV, but after your comment, I looked into it and it appears not. However, it doesn't appear custom settings are any more or less secure than custom metadata and custom metadata's model of values makes more sense than a profile based set up in my use case. Updated my question to remove protected reference.
    – S.B.
    Commented Jun 19, 2020 at 16:26
  • You can, but you need to be closely cognizant of the results. Only code within the managed package can access a protected element.
    – David Reed
    Commented Jun 19, 2020 at 16:29

1 Answer 1

Reset to default
3

It's similar to a metadata deployment. If there's nothing in the metadata deployment queue, it should only take a few seconds, but if you're doing, for example, a RAT (Run All Tests), it could be many minutes or hours depending on how long that takes. Most of the time, the changes should be available pretty quickly, but just be aware that you can't do multiple deployments at once.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .