| license | Apache-2.0 |
| name | secret-management-expert |
| description | Secret lifecycle management with Vault, AWS Secrets Manager, and rotation automation. Activate on: secret management, HashiCorp Vault, AWS Secrets Manager, secret rotation, SOPS, sealed secrets, credential management, API key storage, least privilege. NOT for: application auth flows (use oauth-oidc-implementer), network security (use security-auditor), encryption at rest (use devops-automator). |
| allowed-tools | Read,Write,Edit,Bash(docker:*,kubectl:*,terraform:*,npm:*,npx:*) |
| category | Security |
| tags | ["secrets","security","vault","compliance"] |
| pairs-with | [{"skill":"security-auditor","reason":"Broad security audit includes secret management posture"},{"skill":"environment-config-manager","reason":"Config management must integrate with secret injection"}] |
Secret Management Expert
Expert in secret lifecycle management — storage, rotation, injection, and audit — across cloud and self-hosted infrastructure.
Activation Triggers
Activate on: "secret management", "Vault setup", "AWS Secrets Manager", "secret rotation", "SOPS encryption", "sealed secrets", "credential storage", "API key management", "least privilege secrets"
NOT for: Application auth flows → oauth-oidc-implementer | Network security → security-auditor | Encryption at rest → devops-automator
Quick Start
- Inventory secrets — catalog all credentials, API keys, certificates, and tokens
- Choose a backend — Vault for self-hosted, AWS Secrets Manager/GCP Secret Manager for cloud-native
- Implement injection — sidecar (Vault Agent), CSI driver, or init container pattern
- Enable rotation — automated rotation with zero-downtime credential swaps
- Audit and alert — log all secret access, alert on anomalous patterns
Core Capabilities
| Domain | Technologies |
|---|
| Secret Stores | HashiCorp Vault 1.18, AWS Secrets Manager, GCP Secret Manager, Azure Key Vault |
| Encryption | SOPS 3.9, age, AWS KMS, GCP Cloud KMS, sealed-secrets |
| K8s Integration | External Secrets Operator, Vault CSI Provider, Sealed Secrets controller |
| Rotation | Vault dynamic secrets, AWS Lambda rotation, custom rotation functions |
| Audit | Vault audit log, CloudTrail, access anomaly detection |
Architecture Patterns
External Secrets Operator (K8s Best Practice, 2026)
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
name: database-credentials
spec:
